AzPosture

0.1.0-preview10

checks/entra/ca-mfa-strength.ps1

                                # Does any enabled CA policy targeting directory roles demand an authentication STRENGTH

# (e.g. phishing-resistant MFA) rather than plain "mfa"? Strength is a P1 Conditional Access feature.

if (-not (Test-EntraLicence @('AAD_PREMIUM','AAD_PREMIUM_P2'))) { return Skip-Check 'Authentication strength for admins' 'Conditional Access requires Entra ID P1 (not present on this tenant).' }

. (Join-Path $PSScriptRoot '_ca-common.ps1')

$pols = @(Get-EnabledCaPolicies)

$adminPols = @($pols | Where-Object { @($_.conditions.users.includeRoles).Count -gt 0 })

$strong = @($adminPols | Where-Object { $_.grantControls.authenticationStrength -and $_.grantControls.authenticationStrength.id })

$items = @()

if (-not $strong) {

    $detail = if ($adminPols.Count -gt 0) { "$($adminPols.Count) admin-targeting policies, all rely on the generic 'mfa' grant" }

              else { 'No enabled policy targets directory roles at all' }

    $items += [pscustomobject]@{ Title = 'No authentication strength required for admin sign-in'; Detail = $detail }

}

$names = @($strong | ForEach-Object { $_.grantControls.authenticationStrength.displayName }) -join ', '

$evidence = if ($strong) { "Admin policies enforce authentication strength: $names" }

            else { "$($adminPols.Count) admin-targeting CA policies, none enforce an authentication strength" }

[pscustomobject]@{ Name = 'Authentication strength for admins'; Severity = 'high'

    Evidence = $evidence

    Fix = 'Require a phishing-resistant authentication strength (FIDO2, Windows Hello for Business, or certificate-based) on the Conditional Access policy that covers directory roles.'

    Items = $items }