Azure AD Identity Protection helps detect risky sign-ins and risky users. To mitigate these risks without blocking user access, Microsoft recommends configuring sign-in risk policies to enforce MFA rather than block sign-i ns.
From the SC-300 documentation:
"When you want to remediate sign-in risk without blocking users, configure a Conditional Access or Identity Protection policy to require MFA when a risky sign-in is detected." This approach allows users to verify their id entity and continue to sign in securely, rather than being blocked outright.
Hence, to implement sign-in risk remediation without blocking users, the first step is to enable and enforce MFA for all users so that users can self-remediate risky sign-ins.