A new Microsoft-managed Conditional Access policy is set to begin enforcing risk remediation for high-risk users. For organisations using Microsoft Entra ID P2, now is the time to understand what is changing and make sure your environment is ready.
Microsoft is continuing to strengthen identity security across Microsoft 365, with a new Microsoft-managed Conditional Access policy designed to respond automatically when an account is identified as high risk.
The policy, Require risk remediation for high-risk users, has been created in eligible Microsoft Entra tenants alongside a new security group. It is initially placed into Report-only mode, giving IT teams an opportunity to understand its potential impact before enforcement.
According to Microsoft Message Center notification MC1507808, the current evaluation period ends during the week of 28 October 2026. If the policy remains in Report-only mode and no action is taken, Microsoft will automatically switch it to On.
For businesses using Microsoft Entra ID P2, this is an important change. The policy can make responding to compromised accounts faster and reduce the manual work involved, but it also means businesses need to make sure the right identity controls are already in place.
What is Microsoft changing?
Microsoft-managed Conditional Access policies are preconfigured policies designed to protect Entra environments against common identity risks.
When Microsoft introduces one of these policies, it is generally created in a customer’s tenant in Report-only mode first. Administrators can review its impact, enable it themselves or opt out by setting the policy to Off. If it remains in Report-only mode, Microsoft can enable it automatically after the evaluation period.
The new policy focuses specifically on high-risk users.
Microsoft Entra ID Protection can identify user risk based on signals indicating that an account may have been compromised. Once the policy is active, users classified as High User Risk are prompted to remediate their account rather than simply continuing to access business systems as normal.
In simple terms, that means Microsoft is moving more of the response to identity risk directly into the sign-in process.
What does risk remediation actually do?
The significant part of this change isn’t just detecting a potentially compromised account. It is what happens next.
Microsoft’s Require risk remediation control allows affected users to go through an adaptive remediation process and unblock themselves. Once remediation completes successfully, the risk is cleared and access can be restored without requiring an administrator to manually dismiss it.
The control also supports both password-based and passwordless users, making it more flexible than an approach built solely around requiring a password change.
For IT teams, that’s an important distinction.
When identity security is configured correctly, responding to risk doesn’t always need to begin with a service desk ticket. The security control can step in at the point Microsoft identifies the risk, require the user to remediate it and prevent the account from simply carrying on as normal.
That creates a more immediate response while reducing unnecessary intervention from IT or security teams.
Where could businesses run into problems?
Automatic remediation is useful, but only when the environment around it is properly configured.
One of the most important areas to check is MFA registration.
Microsoft specifically recommends ensuring users are registered for multifactor authentication so they can complete self-remediation when prompted.
There are also accounts that shouldn’t be treated like standard user identities.
Microsoft recommends excluding emergency access or break-glass accounts from Conditional Access policies to reduce the risk of administrators being locked out if a policy is misconfigured. It also distinguishes service accounts and service principals from ordinary users. Calls made by service principals aren’t covered by Conditional Access policies scoped to users, and Microsoft recommends Conditional Access for workload identities where policies need to target service principals.
These aren’t small configuration details. They’re the difference between introducing another security control and introducing it safely.
What should IT teams check before 28 October?
The important thing is not to simply wait for the policy to switch on.
For organisations affected by MC1507808, IT teams should use the remaining evaluation period to understand what the change means within their own Microsoft environment.
That starts with reviewing the Microsoft-managed policy and deciding whether to allow it to become active automatically, turn it on proactively or switch it off if it isn’t appropriate for your organisation. Microsoft also allows administrators to customise aspects of the policy, including exclusions and membership of the associated security group.
Microsoft’s own guidance recommends excluding emergency access accounts from risk-remediation Conditional Access policies.
Your review should therefore cover:
-
whether the Microsoft-managed policy exists in your tenant
-
which users are currently within its scope
-
what the Report-only results are showing
-
whether users are properly registered for MFA
-
whether emergency access accounts have been excluded
-
whether you already have Conditional Access controls addressing high user risk
-
whether service and workload identities have appropriate protection of their own.
The purpose isn’t to turn security controls off because they might create friction. It’s to know how your environment will behave before enforcement begins.
Why this matters beyond one Conditional Access policy
The bigger story here is the direction Microsoft security is moving in.
Identity has become a critical security boundary. Rather than relying entirely on an administrator to notice unusual activity and respond after the event, Microsoft Entra can combine risk detection with Conditional Access to determine what should happen when an identity starts behaving in a way that indicates compromise.
The practical benefit of the new policy is straightforward: a high-risk user can be challenged and required to remediate before normal access continues. Successful remediation can then clear the risk and restore access.
But Microsoft-managed doesn’t mean IT-managed-by-Microsoft.
Your organisation still needs to understand who is covered, what exclusions are appropriate and how Microsoft’s controls fit alongside the Conditional Access policies you already operate.
Secure by default still needs to be managed
At Zenzero, we see Conditional Access as part of a wider identity security strategy, not something businesses should configure once and forget.
Microsoft introducing stronger default controls is a positive step, particularly when those controls help users recover from identity risk without unnecessarily adding work for internal IT teams.
But there is still a job to do before enforcement begins.
Review the policy. Understand its impact. Make sure MFA registration and emergency access arrangements are where they should be. And check how the new Microsoft-managed control fits alongside the policies already protecting your environment.
If you’re unsure how MC1507808 affects your Microsoft 365 environment, or you want to review your Conditional Access and wider identity security configuration before the policy is enforced, Zenzero can help you make sure the right controls are in place without creating unnecessary disruption for your users.
Key Takeaways
-
whether the Microsoft-managed policy exists in your tenant
-
which users are currently within its scope
-
what the Report-only results are showing
-
whether users are properly registered for MFA
-
whether emergency access accounts have been excluded
