manager: pmwongera
ms.service: entra-id
ms.topic: include
ms.date: 03/05/2025
ms.custom: Identity-Secure-Recommendation
# sfipillar: Accelerate response and remediation
# category: Access control
# userimpact: High
# implementationcost: Medium
---
Assume any users at high risk are compromised by threat actors. Without investigation and remediation, threat actors can execute scripts, deploy malicious applications, or manipulate API calls to establish persistence, based on the potentially compromised user's permissions. Threat actors can then exploit misconfigurations or abuse OAuth tokens to move laterally across workloads like documents, SaaS applications, or Azure resources. Threat actors can gain access to sensitive files, customer records, or proprietary code and exfiltrate it to external repositories while maintaining stealth through legitimate cloud services. Finally, threat actors might disrupt operations by modifying configurations, encrypting data for ransom, or using the stolen information for further attacks, resulting in financial, reputational, and regulatory consequences.
**Remediation action**
- Create a Conditional Access policy to [require a secure password change for elevated user risk](/entra/identity/conditional-access/policy-risk-based-user).
- Use Microsoft Entra ID Protection to [further investigate risk](/entra/id-protection/howto-identity-protection-investigate-risk).
manager: pmwongera
ms.service: entra-id
ms.topic: include
ms.date: 07/29/2025
ms.custom: Identity-Secure-Recommendation
# sfipillar: Accelerate response and remediation
# category: Access control
# userimpact: High
# implementationcost: Medium
---
Assume high risk are compromised by threat actors. Without investigation and remediation, threat actors can execute scripts, deploy malicious applications, or manipulate API calls to establish persistence, based on the potentially compromised user's permissions. Threat actors can then exploit misconfigurations or abuse OAuth tokens to move laterally across workloads like documents, SaaS applications, or Azure resources. Threat actors can gain access to sensitive files, customer records, or proprietary code and exfiltrate it to external repositories while maintaining stealth through legitimate cloud services. Finally, threat actors might disrupt operations by modifying configurations, encrypting data for ransom, or using the stolen information for further attacks, resulting in financial, reputational, and regulatory consequences.
Organizations using passwords can rely on password reset to automatically remediate risky users.
Organizations using passwordless credentials already mitigate most risk events that accrue to user risk levels, thus the volume of risky users should be considerably lower. Risky users in an organization that uses passwordless credentials must be blocked from access until the user risk is investigated and remediated.
**Remediation action**
- Create a Conditional Access policy to [require a secure password change for elevated user risk](/entra/identity/conditional-access/policy-risk-based-user).
- Use Microsoft Entra ID Protection to [investigate risk further](/entra/id-protection/howto-identity-protection-investigate-risk).