Policies/NSP-RISK-USER-01.psd1
|
@{ Id = 'NSP-RISK-USER-01' Name = 'Require a password change for a high-risk user' Version = 1 Description = 'A user Entra ID Protection rates high risk (for example, a leaked password) must complete MFA and change their password, which clears the risk.' Notes = 'New with the module (2026-10-09), from the common baselines. Needs Entra ID P2 and self-service password reset (for synced users, password writeback). Used in tenants with RiskPolicies = On.' LegacyNames = @('Require password change for high-risk users', 'CIS - High user risk') Option = 'RiskPolicies=On' DefaultState = 'reportOnly' Users = @{ IncludeUsers = @('All') ExcludeUsers = @('{BreakGlass}', '{ServiceAccounts}') } Applications = @{ Include = @('All') } UserRiskLevels = @('high') Grant = @{ Operator = 'AND' BuiltInControls = @('mfa', 'passwordChange') } Session = @{ SignInFrequency = @{ EveryTime = $true } } } |