Unit 3: Implement and Manage User Risk Policies

Two Core Risk Policies

Identity Protection provides two automated policies.

Sign-in Risk Policy

• Evaluates risk during a sign-in.
• Focuses on the authentication event.
• Common action is requiring MFA.

User Risk Policy

• Evaluates overall account compromise.
• Based on cumulative detections.
• Common action is forcing password reset.

Both policies support self-remediation.

Prerequisites for Self-Remediation

Users must be registered for:

• Multifactor authentication.
• Self-service password reset.

Microsoft strongly recommends combined security info registration.

Self-remediation reduces:

• Helpdesk tickets.
• User downtime.
• Security response time.

Choosing Risk Thresholds

Microsoft’s recommended configuration:

• User risk policy → High.
• Sign-in risk policy → Medium and above.

Lower thresholds increase security but increase user disruption. Higher thresholds reduce friction but allow more risk.

Exclusions and Trusted Locations

Emergency access accounts must always be excluded. Trusted locations reduce false positives in risk detection.