To strengthen your organization's security posture, Microsoft created a new Microsoft‑managed Conditional Access (CA) policy—Require risk remediation for high‑risk users—in your tenant, along with a new security group for this policy. This policy uses Microsoft Entra ID Protection to identify users at high risk and prompts them to self‑remediate through adaptive risk remediation, allowing users to resolve their own risk without administrator intervention.
The policy is currently in report‑only mode and the 30‑day evaluation period is ending soon. If you take no action, the policy will automatically switch to On.
When this will happen
The Microsoft‑managed CA policy was created in report‑only mode.
The week of October 28, 2026: End of evaluation period — policy will be enforced (automatically switched to On)
How this affects your organization
Who is affected
- Organizations with Microsoft Entra ID P2 licenses.
What will happen
- A new Microsoft‑managed Require risk remediation for high‑risk users CA policy is currently in report‑only mode.
- If you do not set the policy to On or Off within the remaining evaluation period, it will automatically turn On.
- When On, users identified as High User Risk will be prompted to self‑remediate. After successful remediation, risk is cleared and access is restored.
- No existing Conditional Access settings or exclusions (such as break‑glass accounts) will be altered.
- The policy will remain enabled by default unless customized.
What you can do to prepare
- Review the policy in the Microsoft Entra admin portal.
- Decide whether to:
- Allow the policy to automatically turn on at the end of the evaluation period, or
- Set it to Off if you do not want the policy enforced.
- Customize the policy as needed (for example, exclude emergency access accounts), or by modifying membership in the policy's security group.
- Ensure users are registered for multifactor authentication so they can complete self‑remediation when prompted.
- If you need assistance, submit a support request: Technical → Microsoft Entra Sign‑In and Multi‑Factor Authentication → Conditional Access → Microsoft‑managed
Learn more:
Compliance considerations
No compliance considerations identified. Review as appropriate for your organization.