public/cisa/entra/Test-MtCisaMfa.ps1

<#
.SYNOPSIS
    Checks if Conditional Access Policy requiring MFA is enabled

.DESCRIPTION
    If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users

.EXAMPLE
    Test-MtCisaMfa

    Returns true if at least one policy requires MFA

.LINK
    https://maester.dev/docs/commands/Test-MtCisaMfa
#>

function Test-MtCisaMfa {
    [CmdletBinding()]
    [OutputType([bool])]
    param()

    if(!(Test-MtConnection Graph)){
        Add-MtTestResultDetail -SkippedBecause NotConnectedGraph
        return $null
    }

    $EntraIDPlan = Get-MtLicenseInformation -Product EntraID
    if($EntraIDPlan -eq "Free"){
        Add-MtTestResultDetail -SkippedBecause NotLicensedEntraIDP1
        return $null
    }elseif(Test-MtCisaPhishResistant){
        Add-MtTestResultDetail -SkippedBecause Custom -SkippedCustomReason "Test-MtCisaPhishResistant Passed"
        return $null
    }

    $result = Get-MtConditionalAccessPolicy | Where-Object { $_.state -eq "enabled" }

    $policies = $result | Where-Object {`
        $_.conditions.applications.includeApplications -contains "All" -and `
        $_.conditions.users.includeUsers -contains "All" -and `
        $_.grantControls.builtInControls -contains "mfa" }

    $testResult = ($policies|Measure-Object).Count -ge 1

    if ($testResult) {
        $testResultMarkdown = "Well done. Your tenant has one or more policies that require MFA:`n`n%TestResult%"
    } else {
        $testResultMarkdown = "Your tenant does not have any conditional access policies that require MFA."
    }
    Add-MtTestResultDetail -Result $testResultMarkdown -GraphObjectType ConditionalAccess -GraphObjects $policies

    return $testResult
}