CISA.MS.AAD.2.2 - A notification SHOULD be sent to the administrator when high-risk users are detected.
Overview
A notification SHOULD be sent to the administrator when high-risk users are detected.
Rationale: Notification enables the admin to monitor the event and remediate the risk. This helps the organization proactively respond to cyber intrusions as they occur.
Remediation action:
Follow the guide below to configure Entra ID Protection to send a regularly monitored security mailbox email notification when user accounts are determined to be high risk.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | CISA.MS.AAD.2.2 |
| Severity | Medium |
| Suite | CISA |
| Product | Entra ID |
| Feature | Identity Protection |
| Area | Logging and detection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.2.2 |
| Criticality | SHOULD |
| Upstream requirement | MS.AAD.2.2v1 |
| Supports controls | cisa-scuba:MS.AAD.2.2, nist-800-53-r5:AC-2(12) |
| PowerShell test | Test-MtCisaNotifyHighRisk |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM_P2 |
Source
- Test:
tests/cisa/entra/Test.CISA.MS.AAD.2.2.ps1 - Documentation:
tests/cisa/entra/Test.CISA.MS.AAD.2.2.md