{"id":16398,"date":"2020-08-12T06:37:27","date_gmt":"2020-08-12T06:37:27","guid":{"rendered":"https:\/\/www.testpreptraining.com\/tutorial\/?page_id=16398"},"modified":"2022-03-14T05:32:10","modified_gmt":"2022-03-14T05:32:10","slug":"configuring-and-enabling-risk-policies","status":"publish","type":"page","link":"https:\/\/www.testpreptraining.ai\/tutorial\/configuring-and-enabling-risk-policies\/","title":{"rendered":"Configuring and Enabling Risk policies"},"content":{"rendered":"\n

Go back to AZ-500 Tutorials<\/a><\/p>\n\n\n\n

In this tutorial, we will learn about configuring and enabling risk policies like Sign-in risk policy and User risk policy. Both policies work to automate the response to risk detections in your environment and allow users to self-remediate when risk is detected.<\/p>\n\n\n\n

Prerequisites<\/strong><\/h6>\n\n\n\n

If your organization wants to give access to users for self-remediation when risks are detected, users must be registered for both self-service password reset and Azure Multi-Factor Authentication. However, we recommend enabling the combined security information registration experience for the best experience. As allowing users for self-remediation gets them back to a productive state without needing administrator intervention. But, the Administrators can still see these events and even investigate them after the fact.<\/p>\n\n\n\n

Choosing acceptable risk levels<\/strong><\/h5>\n\n\n\n

Organizations should decide the risk level, as they are willing to accept balancing user experience and security posture. However, Microsoft’s recommendation is to set the user risk policy threshold to High and the sign-in risk policy to Medium and above.<\/p>\n\n\n\n

Choosing a High threshold decreases the number of times a policy triggers and minimizes the impact to users. However, it removes low and medium risk detections from the policy that may not block an attacker from exploiting a compromised identity. And, selecting a Low threshold will introduce additional user interrupts. But it will increase the security posture.<\/p>\n\n\n\n

Exclusions<\/strong><\/h4>\n\n\n\n

Excluding users such as emergency access or break-glass administrator accounts is possible with any of the policies. Furthermore, companies should determine if additional accounts should be excluded from certain restrictions based on how they are utilised. All exclusions must be reviewed on a regular basis to ensure that they are still valid. However, to reduce false positives, Identity Protection leverages preset trustworthy network locations in some risk detections.<\/p>\n\n\n\n

\"AZ_500<\/a><\/figure><\/div>\n\n\n\n

Enable policies<\/strong><\/h4>\n\n\n\n

For enabling the user risk and sign-in risk policies complete the following steps.<\/p>\n\n\n\n