MT.1049: Conditional Access policies for User Risk and Sign-in Risk should be configured separately.
| ID | MT.1049 |
| Severity | High |
| Suite | Mito |
| Product | Entra ID |
| Feature | Conditional Access |
| Security area | Access control |
| Resource type | ConditionalAccessPolicy |
| User impact of fixing | Low |
| Effort to fix | Low |
| Framework controls | nist-800-53-r5:AC-2(12) Account Management | Account Monitoring for Atypical Usage |
| MITRE ATT&CK | T1078.004 |
| Reads from | Microsoft Graph |
| Licence needed | AAD_PREMIUM_P2 |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Checks if both user risk and sign-in risk are configured in one Conditional Access policy.
Combining sign in risk and user risk in one policy will only block access if both types of risk are flagged for a given sign in.
This means if only one type of risk is present (eg Sign-in risk = High, User risk = None), the sign-in will be allowed to proceed. This could create a security gap since risky activities might slip through.
See Sign-in risk-based multifactor authentication - Microsoft Learn
Mito check. Author: BakkerJan; contributors: merill. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.