Microsoft's managed risk-remediation policy turns on from 28 October

Microsoft's managed risk-remediation policy turns on from 28 October

14 October 2026: Microsoft has created a Conditional Access policy named "Require risk remediation for high-risk users" in affected Microsoft Entra tenants, together with a new security group for it, and says it will be enforced in the week of 28 October 2026. That is when its 30-day report-only evaluation ends and the policy switches itself to On. The notice is Message Center item MC1507808.

Not yet independently verified. Read through the mc.merill.net mirror of the Message Center post, which shows it reached Education tenants; whether it reached every Entra ID P2 tenant is not confirmed. The exact day of the week of 28 October is not given. We will update this when it can be confirmed, and remove this note.

What the policy does

The policy uses Microsoft Entra ID Protection to spot users it rates as high risk. It then prompts them to remediate the risk themselves, so they can resolve it without an administrator. Once remediation succeeds, the risk is cleared and access is restored.

Microsoft says the policy relies on adaptive risk remediation. A user who is not registered for multifactor authentication has no way to complete the prompt, which is why the registration check sits first in the actions below.

Who is covered

The message is aimed at organisations with Microsoft Entra ID P2 licences. The copy of the notice read here appeared in Education tenants. Microsoft states that existing Conditional Access settings and exclusions, such as break-glass accounts, will not be changed by the new policy.

What administrators can do before it turns on

Microsoft lists these actions:

• Review the policy in the Microsoft Entra admin portal.
• Decide whether to let it turn on automatically or set it to Off before the evaluation period ends.
• Customise it, for example by adding exclusions such as emergency access accounts or changing the membership of its security group.
• Confirm that users are registered for multifactor authentication so that they can complete self-remediation.

For help, Microsoft points to a support request under Microsoft Entra Sign-In and Multi-Factor Authentication, then Conditional Access.

The date to watch

Enforcement is due in the week of 28 October 2026, 30 days after the policy was created in report-only mode. Microsoft gives no more precise day in the notice. Once on, the policy stays enabled by default unless an administrator customises it, and the notice lists no compliance considerations for the change.

Sources

• Microsoft 365 Message Center (via mc.merill.net): MC1507808, Microsoft-managed CA policy will be enforced soon, 14 October 2026