📋 Microsoft Entra Documentation Changes

ms.service: entra-id

ms.subservice: authentication

ms.topic: article

ms.author: justinha

author: justinha

manager: dougeby

 

At Microsoft, we're committed to providing our customers with the highest level of security. One of the most effective security measures available to them is multifactor authentication (MFA). [Research by Microsoft](https://www.microsoft.com/security/blog/2019/08/20/one-simple-action-you-can-take-to-prevent-99-9-percent-of-account-attacks) shows that MFA can block more than 99.2% of account compromise attacks.

 

 

There's no change for users if your organization already enforces MFA for them, or if they sign in with stronger methods like passwordless or passkey (FIDO2). To verify that MFA is enabled, see [How to verify that users are set up for mandatory MFA](how-to-mandatory-multifactor-authentication.md).

 

 

For more information about how to migrate from user-based service accounts to workload identities for authentication with these applications, see:

 

- [Sign in to Azure PowerShell non-interactively for automation scenarios](/powershell/azure/authenticate-noninteractive) includes guidance for both managed identity and service principal use cases

Without Conditional Access policies protecting security information registration, threat actors can exploit unprotected registration flows to compromise authentication methods. When users register multifactor authentication and self-service password reset methods without proper controls, threat actors can intercept these registration sessions through adversary-in-the-middle attacks or exploit unmanaged devices accessing registration from untrusted locations. Once threat actors gain access to an unprotected registration flow, they can register their own authentication methods, effectively hijacking the target's authentication profile. The threat actors can bypass security controls and potentially escalate privileges throughout the environment because they can maintain persistent access by controlling the MFA methods. The compromised authentication methods then become the foundation for lateral movement as threat actors can authenticate as the legitimate user across multiple services and applications.

 

**Remediation action**

 

Token protection, also called token binding, helps prevent token theft by making sure a token is usable only from the intended device. Token protection uses cryptography so that without the client device key, no one can use the token.

 

 

**Remediation action**

 

# userimpact: High

# implementationcost: Medium

---

 

Organizations using passwords can rely on password reset to automatically remediate risky users.

 

 

**Remediation action**

 

- Use Microsoft Entra ID Protection to [investigate risk further](/entra/id-protection/howto-identity-protection-investigate-risk).

---

title: Integrate Global Secure Access with Microsoft Sentinel

author: HULKsmashGithub

ms.author: jayrusso

ms.service: global-secure-access

ms.topic: how-to

manager: dougeby

ms.reviewer: kerenSemel

ai-usage: ai-assisted

When high-risk sign-ins are not properly restricted through Conditional Access policies, organizations expose themselves to security vulnerabilities. Threat actors can exploit these gaps for initial access through compromised credentials, credential stuffing attacks, or anomalous sign-in patterns that Microsoft Entra ID Protection identifies as risky behaviors. Without appropriate restrictions, threat actors who successfully authenticate during high-risk scenarios can perform privilege escalation by misusing the authenticated session to access sensitive resources, modify security configurations, or conduct reconnaissance activities within the environment. Once threat actors establish access through uncontrolled high-risk sign-ins, they can achieve persistence by creating additional accounts, installing backdoors, or modifying authentication policies to maintain long-term access to the organization's resources. The unrestricted access enables threat actors to conduct lateral movement across systems and applications using the authenticated session, potentially accessing sensitive data stores, administrative interfaces, or critical business applications. Finally, threat actors achieve impact through data exfiltration, or compromise business-critical systems while maintaining plausible deniability by exploiting the fact that their risky authentication was not properly challenged or blocked.

 

**Remediation action**

 

**Remediation action**

 

Blocking authentication transfer in Microsoft Entra ID is a critical security control. It helps protect against token theft and replay attacks by preventing the use of device tokens to silently authenticate on other devices or browsers. When authentication transfer is enabled, a threat actor who gains access to one device can access resources to nonapproved devices, bypassing standard authentication and device compliance checks. When administrators block this flow, organizations can ensure that each authentication request must originate from the original device, maintaining the integrity of the device compliance and user session context.

 

**Remediation action**

### Build your Conditional Access policies

 

Start with a few core Conditional Access policies like the ones that follow. Many policies are available as [Conditional Access policy templates](concept-conditional-access-policy-common.md). By default, each policy created from a template is in report-only mode. Test and monitor usage, to ensure the intended result, before turning on each policy.

| Conditional Access policy | License requirement |

| --- | --- |

| [Block legacy authentication](/entra/fundamentals/configure-security#block-legacy-authentication) | Microsoft Entra ID P1 |

---

# Block authentication flows with Conditional Access policy

 

 

## Device code flow policies

 

 

- [Get started with a phishing-resistant passwordless authentication deployment](/entra/identity/authentication/how-to-plan-prerequisites-phishing-resistant-passwordless-authentication)

- [Ensure that privileged accounts register and use phishing resistant methods](/entra/identity/authentication/concept-authentication-strengths#authentication-strengths)

- [Monitor authentication method activity](/entra/identity/monitoring-health/concept-usage-insights-report#authentication-methods-activity)

 

- [Get started with a phishing-resistant passwordless authentication deployment](/entra/identity/authentication/how-to-plan-prerequisites-phishing-resistant-passwordless-authentication)

- [Ensure that privileged accounts register and use phishing resistant methods](/entra/identity/authentication/concept-authentication-strengths#authentication-strengths)

- [Monitor authentication method activity](/entra/identity/monitoring-health/concept-usage-insights-report#authentication-methods-activity)

 

- [Get started with a phishing-resistant passwordless authentication deployment](/entra/identity/authentication/how-to-plan-prerequisites-phishing-resistant-passwordless-authentication)

- [Ensure that privileged accounts register and use phishing resistant methods](/entra/identity/authentication/concept-authentication-strengths#authentication-strengths)

- [Monitor authentication method activity](/entra/identity/monitoring-health/concept-usage-insights-report#authentication-methods-activity)

 

- [Deploy multifactor authentication](/entra/identity/authentication/howto-mfa-getstarted)

- [Get started with a phishing-resistant passwordless authentication deployment](/entra/identity/authentication/how-to-plan-prerequisites-phishing-resistant-passwordless-authentication)

- [Review authentication methods activity](/entra/identity/monitoring-health/concept-usage-insights-report?tabs=microsoft-entra-admin-center#authentication-methods-activity)