CISA.MS.AAD.2.1 - Users detected as high risk SHALL be blocked.

Contributed by Michael Soule with Merill FernandoAll contributors →

Overview

Users detected as high risk SHALL be blocked.

Rationale: Blocking high-risk users may prevent compromised accounts from accessing the tenant.

Remediation action:

Create a Conditional Access policy blocking users categorized as high risk by Microsoft Entra ID Protection. Configure the following policy settings in the new Conditional Access policy as per the values below:

• Users > Include > All users
• Target resources > Cloud apps > All cloud apps
• Conditions > User risk > High
• Access controls > Grant > Block Access

Note: While CISA recommends blocking, the Microsoft recommendation is to require multi-factor authentication for high-risk users.

Related links

• CISA Risk Based Policies - MS.AAD.2.1
• CISA ScubaGear Rego Reference

Test Metadata

Field	Value
Test ID	CISA.MS.AAD.2.1
Severity	High
Suite	CISA
Product	Entra ID
Feature	Conditional Access
Area	Access control
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1078.004 Cloud Accounts
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.2.1
Criticality	SHALL
Upstream requirement	MS.AAD.2.1v1
Supports controls	cisa-scuba:MS.AAD.2.1, nist-800-53-r5:AC-2(12), nist-800-53-r5:AC-2(13)
PowerShell test	Test-MtCisaBlockHighRiskUser
Services	Graph
Compatible licenses	AAD_PREMIUM_P2

Source

• Test: tests/cisa/entra/Test.CISA.MS.AAD.2.1.ps1
• Documentation: tests/cisa/entra/Test.CISA.MS.AAD.2.1.md