High-risk sign-in events must be remediated within 24h

Requirement

Entra Identity Protection flags risky sign-ins (impossible travel, leaked credentials, unfamiliar properties). Risky users surfaced as riskLevel=high or medium must be remediated (password reset + MFA challenge) within 24 hours of detection.

Remediation guidance

For any riskState=atRisk older than 24h: trigger the user-risk remediation flow (force password change + MFA re-registration), then confirm riskState moves to remediated. Document the action in the operator's incident log.

Evidence specification

{
  "query": "signin_risk_events",
  "required_fields": [
    "id",
    "userPrincipalName",
    "riskLevel",
    "riskState",
    "riskLastUpdatedDateTime"
  ]
}

Recent evaluations (Apollo Gaming Ltd.)