Block

CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskUser

Block access

About this policy

The CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskUser policy blocks access for internal users that Entra ID Protection flags as high risk. A high user risk score usually means leaked credentials or a pattern of suspicious activity, so rather than letting the account carry on, this policy stops it in its tracks until someone investigates and remediates. It applies to all cloud apps and platforms for the internals group, and you will need Entra ID P2 licensing for the risk signals.

Policy conditions

Users: Specific users
Apps: All cloud apps
Risk: User risk: high

JSON template

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies/$entity",
  "@odata.type": "#microsoft.graph.conditionalAccessPolicy",
  "@odata.id": "identity/conditionalAccess/policies('d367aefa-e32c-4382-bfdc-a903896ba628')",
  "@odata.editLink": "identity/conditionalAccess/policies('d367aefa-e32c-4382-bfdc-a903896ba628')",
  "templateId": "6b619f55-792e-45dc-9711-d83ec9d7ae90",
  "displayName": "CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskUser",
  "createdDateTime@odata.type": "#DateTimeOffset",
  "modifiedDateTime@odata.type": "#DateTimeOffset",
  "state@odata.type": "#microsoft.graph.conditionalAccessPolicyState",
  "state": "enabled",
  "deletedDateTime": null,
  "partialEnablementStrategy": null,
  "sessionControls": null,
  "conditions": {
    "@odata.type": "#microsoft.graph.conditionalAccessConditionSet",
    "userRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
    "userRiskLevels": [
      "high"
    ],
    "signInRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
    "signInRiskLevels": [],
    "clientAppTypes@odata.type": "#Collection(microsoft.graph.conditionalAccessClientApp)",
    "clientAppTypes": [
      "all"
    ],
    "platforms": null,
    "locations": null,
    "times": null,
    "deviceStates": null,
    "devices": null,
    "clientApplications": null,
    "agents": null,
    "applications": {
      "@odata.type": "#microsoft.graph.conditionalAccessApplications",
      "includeApplications@odata.type": "#Collection(String)",
      "includeApplications": [
        "All"
      ],
      "excludeApplications@odata.type": "#Collection(String)",
      "excludeApplications": [],
      "includeUserActions@odata.type": "#Collection(String)",
      "includeUserActions": [],
      "includeAuthenticationContextClassReferences@odata.type": "#Collection(String)",
      "includeAuthenticationContextClassReferences": [],
      "applicationFilter": null
    },
    "users": {
      "@odata.type": "#microsoft.graph.conditionalAccessUsers",
      "includeUsers@odata.type": "#Collection(String)",
      "includeUsers": [],
      "excludeUsers@odata.type": "#Collection(String)",
      "excludeUsers": [],
      "includeGroups@odata.type": "#Collection(String)",
      "includeGroups": [
        "ceeac9b8-ddf5-48cb-afcb-e2ab8bfd1a57"
      ],
      "excludeGroups@odata.type": "#Collection(String)",
      "excludeGroups": [
        "2802b872-ccfb-4b29-a9a9-459808dfb11b",
        "c80b6cc8-5981-484b-80f2-da0387fe4393"
      ],
      "includeRoles@odata.type": "#Collection(String)",
      "includeRoles": [],
      "excludeRoles@odata.type": "#Collection(String)",
      "excludeRoles": [],
      "includeGuestsOrExternalUsers": null,
      "excludeGuestsOrExternalUsers": null
    }
  },
  "grantControls": {
    "@odata.type": "#microsoft.graph.conditionalAccessGrantControls",
    "operator": "OR",
    "builtInControls@odata.type": "#Collection(microsoft.graph.conditionalAccessGrantControl)",
    "builtInControls": [
      "block"
    ],
    "customAuthenticationFactors@odata.type": "#Collection(String)",
    "customAuthenticationFactors": [],
    "termsOfUse@odata.type": "#Collection(String)",
    "termsOfUse": [],
    "authenticationStrength@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies('d367aefa-e32c-4382-bfdc-a903896ba628')/grantControls/authenticationStrength/$entity",
    "authenticationStrength@odata.associationLink": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('d367aefa-e32c-4382-bfdc-a903896ba628')/grantControls/authenticationStrength/$ref",
    "authenticationStrength@odata.navigationLink": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('d367aefa-e32c-4382-bfdc-a903896ba628')/grantControls/authenticationStrength",
    "authenticationStrength": null
  },
  "#microsoft.graph.restore": {
    "title": "microsoft.graph.restore",
    "target": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('d367aefa-e32c-4382-bfdc-a903896ba628')/microsoft.graph.restore"
  },
  "Tag": "jv-CAF-2026.2.1",
  "summary": "The CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskUser policy blocks access for internal users that Entra ID Protection flags as high risk. A high user risk score usually means leaked credentials or a pattern of suspicious activity, so rather than letting the account carry on, this policy stops it in its tracks until someone investigates and remediates. It applies to all cloud apps and platforms for the internals group, and you will need Entra ID P2 licensing for the risk signals."
}