Entra Risk Policies Replaced: Act Now

Key insights

• Retirement timeline: Microsoft retired the legacy user risk and sign-in risk policies in Entra ID Protection on October 1, 2026.
  Admins should treat those policies as moved, not deleted—if you relied on ID Protection rules and did not rebuild them in Conditional Access, risky sign-ins may no longer be handled.
• Where to recreate policies: Rebuild risk rules as Conditional Access policies that use the platform’s full set of conditions (user risk, sign-in risk, apps, locations, device compliance, authentication strength).
  This moves risk decisions into the same engine used for MFA, session controls, and app access.
• Sign-in risk policy guidance: For risky sign-ins, target Medium and High sign-in risk levels, require MFA and enforce strong authentication strength, and set sign-in frequency to prompt as needed (for highest-risk scenarios consider "every time").
  Apply the policy to specific apps or users to avoid broad lockouts.
• User risk policy guidance: Treat High user risk as a remediation event—require password change or other verification and block access if remediation fails.
  Exclude break-glass or emergency accounts from enforcement to avoid service outages.
• Test and validate: Use Report-only mode and the What If tool to preview matches and impacts before enforcement.
  Validate logs, confirm exclusions, then enable policies and only afterwards retire the old ID Protection settings.
• Licensing and best practice: Risk-based Conditional Access actions require Entra ID P2; Microsoft 365 Business Premium includes P1 only, so tenants must obtain P2 or comparable licensing for full risk features.
  Adopt these policies to gain a unified policy engine and better alignment with Zero Trust practices.

Keywords

Microsoft Entra risk policies replacement, Entra risk policies retired, replace Entra risk policies with Conditional Access, migrate Entra risk policies, Entra identity protection alternatives, Conditional Access for Entra, risk-based access Microsoft Entra, Entra security policy update