The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →To respond to risky travel sign-ins, create a Microsoft Entra Conditional Access policy that uses the Sign-in risk condition and requires multifactor authentication (MFA) for the risk levels your organization chooses. Entra ID Protection’s atypical-travel detection is a risk signal—not a guarantee that every trip will be flagged or proof that an account is compromised. Start the policy in report-only mode, validate its effect, and enforce it only after review.
What Entra means by risky travel
Microsoft Entra ID Protection can identify sign-in risk using detections such as atypical travel and unfamiliar sign-in properties. They are distinct signals that may contribute to a sign-in risk assessment; neither is a promise that Entra will detect every trip. Microsoft describes atypical travel as difficult to simulate and says its algorithm attempts to filter false positives, including travel from familiar devices and sign-ins through VPNs used by other people in the directory. A location anomaly should therefore be treated as a reason to apply an appropriate control, not as proof of compromise. Microsoft’s risk-detection documentation explains these signals.
As an Amazon Associate I earn from qualifying purchases.
Microsoft defines sign-in risk as “the likelihood that an authentication request isn’t from the identity owner.” In a risk-based Conditional Access policy, that assessment can be used to require MFA or apply another configured access decision.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minutePrerequisites and policy design
The documented risk-based Conditional Access capability requires Microsoft Entra ID P2. Microsoft also identifies Entra Suite as providing full access to ID Protection features, so verify the tenant’s current entitlement before rollout. Microsoft’s sign-in risk-based MFA guidance covers the licensing and user experience considerations.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Decide which users and resources should be covered, which risk levels warrant action, and what MFA method or authentication strength is suitable. Microsoft’s example uses medium and high sign-in risk, but that is a starting point to assess—not a universal threshold. Exclude emergency access (break-glass) accounts from the policy so that a policy error or authentication problem is less likely to lock administrators out. Ensure affected users can complete the required MFA method; Microsoft warns that users who are not registered for MFA can be blocked during risky sessions.
Configure the sign-in risk policy
- Open Conditional Access. In the Microsoft Entra admin center, go to Entra ID > Conditional Access and create a new policy. Give it a name that identifies its purpose and audience. See Microsoft’s policy example.
- Set the assignments. Select the intended users and resources. Microsoft’s example targets all users and all resources; validate that scope against your organization’s access model. Exclude emergency access accounts.
- Choose the risk condition. Under Conditions > Sign-in risk, enable the condition and select the risk levels to address. Medium and high are Microsoft’s example, not a prescribed setting for every tenant.
- Choose the access control. Under Access controls > Grant, require MFA, using an authentication strength appropriate to your organization. Confirm that affected users are registered and able to satisfy it.
- Evaluate before enforcing. Set the policy to Report-only. Review its policy impact and sign-in results, investigate unexpected matches or exclusions, and adjust the scope or controls before switching the policy on. Microsoft explains the report-only mode and its evaluation results.
Keep sign-in risk and user risk in separate Conditional Access policies. Microsoft’s risk-policy guidance advises against combining those two conditions in one policy.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Where named locations fit
A named location represents configured countries or regions, or IP ranges, and can be selected as a network condition in Conditional Access. It can provide context for known networks or support a separate policy that blocks or otherwise controls access from a selected location. Microsoft notes that trusted or known locations can improve ID Protection risk-calculation accuracy. A named location does not independently determine whether someone’s journey between locations was physically possible. See Microsoft’s named-location and network-condition guidance.
If you need a location-based block, configure the named location, target the appropriate users and resources, select the location under the network condition, and choose the relevant grant control. Evaluate that policy in report-only mode and protect emergency access accounts before enforcing it.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How the related controls differ
| Control | Signal | Policy mechanism and response | Prerequisite |
|---|---|---|---|
| Entra ID Protection sign-in risk | Risk detections can include atypical travel and unfamiliar sign-in properties. | A Conditional Access sign-in risk condition can require MFA or apply another configured access decision. | Microsoft Entra ID P2 for the documented risk-based Conditional Access capability. |
| Named-location condition | Configured country/region or IP-range context. | A Conditional Access network condition can control access from selected locations, including blocking it where configured. | A named location must be configured; it is not itself a travel-anomaly detector. |
| Defender for Cloud Apps impossible-travel detection | Activity from two locations in less time than travel would permit. | An anomaly detection for activity in connected apps; it is separate from Entra ID Protection sign-in risk. | At least one connected app using app connectors. |
Microsoft documents the separate Defender for Cloud Apps impossible-travel anomaly. Do not treat that alert as the Entra sign-in risk condition used in the policy above.
Quick Recap
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Review before turning the policy on
- Confirm the tenant has the required entitlement and that the policy targets the intended users and resources.
- Check that emergency access accounts are excluded and that affected users can complete the required MFA method.
- Review report-only results for unexpected impact before enforcing the policy.
- Keep sign-in risk and user risk in separate policies, and use named locations only for location or network context.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
