Microsoft Entra ID

Managed Policies

8 August 2026Updated+4 / −4 lines

In brief

The documentation now says Microsoft may enable managed policies at least 30 days after introduction when they remain in Report-only, instead of 45 days. It also documents that a security group is created with the high-risk remediation policy.

What Entra admins need to know

Administrators have less time to review policies before automatic enablement. They can enable policies earlier or set them to Off, and should account for the new security group when assessing policy scope.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

The policy includes preconfigured conditions and recommended controls, such as requiring multifactor authentication.
Administrators don't need to manually create these policies. Microsoft manages the policy template, configuration, and updates to ensure it aligns with current security guidance.

Microsoft enables these policies no less than 4530 days after they're introduced in your tenant if they're left in the Report-only state. You can turn on these policies sooner, or opt out by setting the policy state to Off. Customers are notified through emails and Message center posts ~~28 days~~2 weeks before the policies are enabled.

Require remediation for high-risk users

This policy requires users identified as high risk by Microsoft Entra ID Protection to remediate their risk before continuing to access organizational resources. A new security group is created alongside this policy to scope the affected users. Instead of blocking access entirely, this policy uses adaptive risk remediation to guide users through the appropriate recovery flow based on their authentication method and the type of threat detected. For more information about the remediation experience, see User self-remediation with Microsoft Entra ID Protection.

This policy targets:

@@ -33,10 +33,10 @@ Microsoft-managed policies are preconfigured Conditional Access policies that ar - The policy includes preconfigured conditions and recommended controls, such as requiring multifactor authentication.  - Administrators don't need to manually create these policies. Microsoft manages the policy template, configuration, and updates to ensure it aligns with current security guidance. -Microsoft enables these policies no less than 45 days after they're introduced in your tenant if they're left in the **Report-only** state. You can turn on these policies sooner, or opt out by setting the policy state to **Off**. Customers are notified through emails and [Message center](/microsoft-365/admin/manage/message-center) posts 28 days before the policies are enabled. +Microsoft enables these policies no less than 30 days after they're introduced in your tenant if they're left in the **Report-only** state. You can turn on these policies sooner, or opt out by setting the policy state to **Off**. Customers are notified through emails and [Message center](/microsoft-365/admin/manage/message-center) posts 2 weeks before the policies are enabled.   > [!NOTE]-> In some cases, policies might be enabled faster than 45 days. If this change applies to your tenant:+> In some cases, policies might be enabled faster than 30 days. If this change applies to your tenant: >  > - It's mentioned in emails and Microsoft 365 message center posts you receive about Microsoft-managed policies.  > - It's mentioned in the policy details in the Microsoft Entra admin center.@@ -157,10 +157,10 @@ Administrators can review policy impact in report-only mode, exclude emergency a  ### Require remediation for high-risk users -This policy requires users identified as high risk by Microsoft Entra ID Protection to remediate their risk before continuing to access organizational resources. Instead of blocking access entirely, this policy uses [adaptive risk remediation](https://learn.microsoft.com/entra/id-protection/concept-identity-protection-user-experience) to guide users through the appropriate recovery flow based on their authentication method and the type of threat detected. For more information about the remediation experience, see [User self-remediation with Microsoft Entra ID Protection](https://learn.microsoft.com/entra/id-protection/concept-identity-protection-user-experience).+This policy requires users identified as high risk by Microsoft Entra ID Protection to remediate their risk before continuing to access organizational resources. A new security group is created alongside this policy to scope the affected users. Instead of blocking access entirely, this policy uses [adaptive risk remediation](/entra/id-protection/concept-identity-protection-user-experience) to guide users through the appropriate recovery flow based on their authentication method and the type of threat detected. For more information about the remediation experience, see [User self-remediation with Microsoft Entra ID Protection](/entra/id-protection/concept-identity-protection-user-experience).  > [!NOTE]-> **Hybrid tenants:** Eligible tenants have password hash sync enabled, so affected users can self-remediate through a secure password change after completing MFA. Ensure your users are registered for MFA. For more information, see [Considerations for cloud and hybrid users](https://learn.microsoft.com/entra/id-protection/howto-identity-protection-remediate-unblock#considerations-for-cloud-and-hybrid-users).+> **Hybrid tenants:** Eligible tenants have password hash sync enabled, so affected users can self-remediate through a secure password change after completing MFA. Ensure your users are registered for MFA. For more information, see [Considerations for cloud and hybrid users](/entra/id-protection/howto-identity-protection-remediate-unblock#considerations-for-cloud-and-hybrid-users).  This policy targets: