Back to Checks
m365

Conditional Access Policy blocks access for users with elevated insider risk

entra_conditional_access_policy_block_elevated_insider_risk
Service: entraSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accesse5
Resource Type:NotDefined

This check verifies that at least one enabled Conditional Access policy blocks access to all cloud applications for users flagged with an elevated insider risk level by Microsoft Purview Insider Risk Management and Adaptive Protection.

Prowler logoProwlerprowler-provider-m365

Risk

Without blocking elevated insider risk users, compromised or malicious insiders retain full access to cloud applications. This enables data exfiltration, unauthorized modifications, and lateral movement, directly impacting confidentiality and integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks entra_conditional_access_policy_block_elevated_insider_risk

Recommendation

Configure Adaptive Protection in Microsoft Purview to classify insider risk tiers, then create a Conditional Access policy that blocks access to all cloud apps for users with elevated risk. Only exclude dedicated break-glass accounts.

Remediation

Other

1In the Microsoft Entra admin center, go to Protection > Conditional Access > Policies.
2Click New policy.
3Under Users, select Include > All users.
4Under Target resources, select Include > All cloud apps.
5Under Conditions > Insider risk, select Configure > Yes, then check Elevated.
6Under Grant, select Block access.
7Set Enable policy to On and click Create.

Check Code

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.entra.entra_client import entra_client
from prowler.providers.m365.services.entra.entra_service import (
    ConditionalAccessGrantControl,
    ConditionalAccessPolicyState,
    InsiderRiskLevel,
)


class entra_conditional_access_policy_block_elevated_insider_risk(Check):
    """Check if a Conditional Access policy blocks all cloud app access for elevated insider risk users.

    This check verifies that at least one enabled Conditional Access policy
    blocks access to all cloud applications for users with an elevated insider
    risk level, as determined by Microsoft Purview Insider Risk Management
    and Adaptive Protection.

    - PASS: An enabled CA policy blocks all cloud app access for elevated insider risk users.
    - FAIL: No enabled CA policy blocks broad cloud app access based on insider risk signals.
    """

    def execute(self) -> list[CheckReportM365]:
        """Execute the check logic.

        Returns:
            A list of reports containing the result of the check.
        """
        findings = []
        report = CheckReportM365(
            metadata=self.metadata(),
            resource={},
            resource_name="Conditional Access Policies",
            resource_id="conditionalAccessPolicies",
        )
        report.status = "FAIL"
        report.status_extended = "No Conditional Access Policy blocks access for users with elevated insider risk."

        for policy in entra_client.conditional_access_policies.values():
            if policy.state == ConditionalAccessPolicyState.DISABLED:
                continue

            if not policy.conditions.application_conditions:
                continue

            if "All" not in policy.conditions.user_conditions.included_users:
                continue

            if (
                "All"
                not in policy.conditions.application_conditions.included_applications
            ):
                continue

            if (
                ConditionalAccessGrantControl.BLOCK
                not in policy.grant_controls.built_in_controls
            ):
                continue

            if policy.conditions.insider_risk_levels is None:
                report = CheckReportM365(
                    metadata=self.metadata(),
                    resource=policy,
                    resource_name=policy.display_name,
                    resource_id=policy.id,
                )
                report.status = "FAIL"
                if policy.state == ConditionalAccessPolicyState.ENABLED_FOR_REPORTING:
                    report.status_extended = f"Conditional Access Policy {policy.display_name} is configured in report-only mode to block all cloud apps and Microsoft Purview Adaptive Protection is not providing insider risk signals."
                else:
                    report.status_extended = f"Conditional Access Policy {policy.display_name} is configured to block all cloud apps and Microsoft Purview Adaptive Protection is not providing insider risk signals."
                continue

            if policy.conditions.insider_risk_levels != InsiderRiskLevel.ELEVATED:
                continue

            report = CheckReportM365(
                metadata=self.metadata(),
                resource=policy,
                resource_name=policy.display_name,
                resource_id=policy.id,
            )

            if policy.state == ConditionalAccessPolicyState.ENABLED_FOR_REPORTING:
                report.status = "FAIL"
                report.status_extended = f"Conditional Access Policy {policy.display_name} reports blocking all cloud apps for elevated insider risk users but does not enforce it."
            else:
                report.status = "PASS"
                report.status_extended = f"Conditional Access Policy {policy.display_name} blocks access to all cloud apps for users with elevated insider risk."
                break

        findings.append(report)
        return findings

References