MFA Security Issues

Is Risk-Based MFA Secure for Microsoft 365? Setup Guide

Adam Davis Oct 23, 2026 868 views

Question details

The user wants to evaluate the security effectiveness of risk-based multifactor authentication (MFA) for Microsoft 365 and understand how to manage risk policies, exclusions, and session controls.

Is Risk-Based MFA Secure for Microsoft 365 Users?

Product: Microsoft 365
Device & OS: not provided
Scenario: Evaluating and configuring risk-based authentication policies to secure organizational user access while minimizing friction for legitimate sign-ins.
Observed behavior: Seeking best practices for implementing robust MFA policies based on user and sign-in risk levels using Microsoft Entra Identity Protection.

Before you start

Ensure your organization has Microsoft Entra ID P2 (formerly Azure AD Premium P2) licenses, as Identity Protection and risk-based Conditional Access policies require this licensing tier.

Solution 1Recommended

Configure Risk-Based Conditional Access Policies

Set up Microsoft Entra ID policies to enforce MFA automatically when a medium or high sign-in risk is detected.

Risk-based MFA is highly secure because it adapts to real-time threat intelligence. Instead of prompting for MFA on every sign-in, it requires strong authentication only when suspicious behavior (like anonymous IP addresses or atypical travel) is detected.

Access Conditional Access

Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator. Browse to Protection > Conditional Access > Policies and select 'New policy'.

Assign Users and Exclusions

Under 'Assignments', select 'Users' and include your targeted user groups. It is highly recommended to exclude emergency access (break-glass) accounts to prevent accidental tenant lockouts.

Select Target Resources

Under 'Target resources', select 'Cloud apps' and then choose 'All cloud apps' to ensure comprehensive coverage.

Configure Sign-in Risk Conditions

Navigate to 'Conditions' > 'Sign-in risk'. Set 'Configure' to 'Yes' and check the boxes for 'High' and 'Medium' risk levels.

Enforce MFA and Save

Under 'Access controls' > 'Grant', select 'Grant access' and check 'Require multifactor authentication'. Switch the policy state to 'On' and click 'Create'.

Configure Risk-Based Conditional Access Policies

Best Practice: Start by setting the policy state to 'Report-only' to evaluate the impact on users before fully enforcing the MFA requirement.

Solution 2

Monitor Risk Detections and Adjust Controls

Continuously review Microsoft Entra Identity Protection reports to refine your MFA security posture and address compromised accounts.

Free Microsoft Office alternative

Enhance Document Security with WPS Office

While you secure your Microsoft 365 cloud identity with risk-based MFA, you may also need a lightweight, secure desktop productivity suite. WPS Office offers complete format compatibility with Microsoft Office formats, built-in document encryption, and a familiar interface—all for free.

1. Download and Install: Download WPS Office for free from the official website and install it on your device.
2. Open Your Document: Launch WPS Writer, Spreadsheets, or Presentation, and open the file you want to secure.
3. Apply Password Encryption: Navigate to the 'Protect' tab or click 'Menu' > 'Document Encryption', then set a strong password to restrict viewing or editing.

Free and lightweight office suite with a familiar user interfaceFully compatible with Microsoft Office formats (.docx, .xlsx, .pptx)Built-in document encryption and permission controls to protect sensitive dataSeamless offline editing with robust local security features

microsoft office alternative - wps office

Frequently Asked Questions

What is the difference between user risk and sign-in risk in Microsoft 365?

User risk indicates that an identity or account might be compromised (such as leaked credentials found on the dark web). Sign-in risk refers to the probability that a specific authentication request wasn't authorized by the account owner, such as a login attempt from an anonymous IP address.

Can I exclude specific users from risk-based MFA policies?

Yes, you can configure exclusions in your Conditional Access policies. It is highly recommended to exclude emergency access accounts (break-glass accounts) and certain critical service accounts to prevent tenant-wide lockouts during an outage.

Does risk-based MFA require a specific Microsoft 365 license?

Yes, implementing risk-based Conditional Access policies through Microsoft Entra Identity Protection requires a Microsoft Entra ID P2 (formerly Azure AD Premium P2) license. Tenants with P1 licenses can only use standard Conditional Access without real-time risk evaluation.

Will risk-based MFA block legitimate users traveling abroad?

It might trigger an MFA prompt due to 'Atypical travel' or 'Unfamiliar sign-in properties'. However, as long as the user can successfully complete the MFA challenge, they will be granted access, and the system will learn this new behavior over time.

Microsoft Office Security Issues