Ensure Multi-factor Authentication is Required for Risky Sign-ins

Why This Matters

Risky sign-ins represent high probability attempts by threat actors to compromise user accounts. Without requiring multifactor authentication (MFA) for these events, even a detected risky login can succeed with only a password, bypassing your strongest identity protection. Enforcing MFA at the point of risk stops credential theft and phishing attacks in their tracks.

What Aether365 Checks

Aether365 verifies that a Conditional Access policy exists in Microsoft Entra ID which requires MFA for sign-ins classified with medium to high risk. This check appears in the Aether365 dashboard under entra-id checks.

Microsoft references

• Howto conditional access policy admin mfa
• Security emergency access
• Troubleshoot conditional access what if
• Plan conditional access
• Security controls v3 identity management