The replacement risk policy does not cover guests (and the old one never did)
On 1 October the deadline for the legacy Entra ID Protection risk policies fell due. No outage, no warning —just as there was none on 31 July 2025, when those screens went read-only. Inside: the date with the two different wordings Microsoft uses; why almost all the coverage says the policies "stop being enforced" when the original announcement spoke of retiring the interface, and why we will not write a sentence Microsoft has not written; why "migrate" describes a rebuilding job badly, and the order of the two mandatory steps; the two settings the recommended control applies by itself —authentication strength and "every time" reauthentication, the latter mandatory—; the line we found in no guide: "Require risk remediation" is not supported for external and guest users, and the part almost nobody tells you: with the previous policy, you blocked the risky guest with no way of unblocking them and without seeing them in any report; what Microsoft actually recommends for guests —exclude them from risk-based MFA and require MFA always— with its two traps; how to prove it is migrated by reading the log, with the trap of the field called "applied" that also lists the ones that were not; and the exception Microsoft documents with its AppId.
Microsoft 365
ES 
CAT 
EN