João Paulo Costa
As the digital security landscape continues to evolve, organizations utilizing Microsoft Azure are encouraged to migrate their Identity Protection risk policies to Conditional Access. With Microsoft’s announcement that legacy risk policies in Microsoft Entra ID Protection will be retired on October 1, 2026, now is the crucial time to plan and execute this transition. This guide not only walks you through the migration process but also incorporates Microsoft’s recommended practices for configuring risk policies to protect your organization effectively.
Understanding the Importance of Migration
The retirement of the old risk policies necessitates a shift to a more robust and integrated system. Conditional Access provides a more dynamic framework that allows for real-time assessments and adaptive responses to identity-based threats, making it a superior choice for managing security risks in Azure.
Preparing for Migration
Begin by auditing your existing risk policies in Microsoft Entra ID Protection. Identify which configurations are active and understand their implications to ensure that all critical aspects of your security setup are transitioned without loss of coverage.
Detailed Migration Steps
Step 1: Access the Conditional Access Portal
Navigate to the Azure portal, locate the Entra section, Security and then select Conditional Access. This hub will be your new center for configuring identity-based policies.
Step 2: Replicate Existing Risk Policies
Create new Conditional Access policies that correspond to each of your existing risk policies. Carefully replicate the conditions and settings to ensure continuity in policy enforcement.
Step 3: Configure Microsoft’s Recommended Settings
-
User Risk Policy
-
For high user risk levels, configure the policy to require a secure password change. Ensure Microsoft Entra multifactor authentication (MFA) is mandatory before allowing password resets with password writeback, effectively remediating user risk.
Sign-in Risk Policy
-
Set the policy to require Microsoft Entra MFA for medium or high sign-in risks. This enables users to authenticate their identities securely, mitigating potential access risks.
Step 4: Set Conditional Access Controls
Define what actions should occur when your conditions are met, such as blocking access or requiring additional authentication. This step is crucial in maintaining security without overly disrupting user experience.
Step 5: Implement Exclusions Strategically
Consider excluding critical accounts like emergency access or break-glass administrator accounts from certain policies. Regularly review these exclusions to ensure they remain relevant and secure.
Step 6: Activate and Monitor Your Policies
Deploy your policies in ‘Report-only’ mode initially to observe their impact. Adjust as necessary before fully enabling them to avoid unintended access issues.
Decommissioning Old Policies
Once you are confident that the new Conditional Access policies effectively cover all scenarios previously handled by the old system, you can safely decommission the outdated policies.
Conclusion
Migrating from Identity Protection risk policies to Conditional Access is a pivotal move towards a more integrated and proactive security approach within Microsoft Azure. By adhering to Microsoft’s recommendations and following this detailed migration plan, organizations can enhance their security measures effectively while minimizing disruptions. Always stay updated with Azure’s best practices and leverage available tools like Conditional Access templates to streamline your security operations further.
Joao Paulo Costa
