Shut these doors, in this order

Each door is one change, ordered by the exposure it removes and the certification requirements it completes per hour of work. Fixes interact, so the order is recalculated after every one.

Now · 5.5 hours

−9.9 exposure2 hoursIDN-010
Microsoft scores every sign-in for signs of attack - password spraying, leaked credentials, impossible travel, anomalous tokens. A risk-based policy acts on that score automatically instead of letting a suspicious sign-in through.
1. Entra admin centre > Protection > Conditional Access > New policy from template > 'Require multifactor authentication for risky sign-ins'.
2. Set sign-in risk to Medium and High; grant: require MFA (or block High). Exclude break-glass accounts.
3. Add the 'Require password change for high-risk users' template so leaked credentials are rotated.
Sign-in and user risk conditions need Entra ID P2 (Microsoft 365 E5, or the Entra ID P2 add-on).

Shut these doors, in this order

Now · 5.5 hours

Next 30 days · 17 hours

Next 90 days · 7 hours