Risk-based policies and user impact

Overview

Entra ID Protection risky sign-ins can block or require password change—tune to avoid helpdesk meltdown.

Policy design

Start with medium+ users only requiring MFA override; avoid immediate block until noise understood.

User experience

Clear My Sign-ins and helpdesk macro explaining travel/VPN false positives.

Integration

Feed risky users into SOC review when repeated impossible travel from corporate assets (possible token theft).

Review

Monthly false positive rate goal <5% of risky events after tuning.