NSP.M365.ConditionalAccess

0.1.0

Policies/NSP-ADMIN-MFA-02.psd1

                                @{

    Id = 'NSP-ADMIN-MFA-02'

    Name = 'Require phishing-resistant MFA for administrative roles'

    Version = 1

    Description = 'Holders of privileged directory roles must sign in with a security key, Windows Hello for Business, or a passkey. Replaces NSP-ADMIN-MFA-01 in tenants with AdminMfa = PhishingResistant.'

    Notes = 'New with the module (2026-10-09). Uses the built-in Phishing-resistant MFA strength. Switch only once every admin has such a method registered, or they are locked out of admin work.'

    Option = 'AdminMfa=PhishingResistant'

    DefaultState = 'reportOnly'

    Users = @{

        IncludeRoles = @(

            '{Role:ApplicationAdministrator}'

            '{Role:AuthenticationAdministrator}'

            '{Role:AuthenticationPolicyAdministrator}'

            '{Role:BillingAdministrator}'

            '{Role:CloudApplicationAdministrator}'

            '{Role:ConditionalAccessAdministrator}'

            '{Role:ExchangeAdministrator}'

            '{Role:HelpdeskAdministrator}'

            '{Role:PasswordAdministrator}'

            '{Role:PrivilegedAuthenticationAdministrator}'

            '{Role:PrivilegedRoleAdministrator}'

            '{Role:SecurityAdministrator}'

            '{Role:SharePointAdministrator}'

            '{Role:TeamsAdministrator}'

            '{Role:UserAdministrator}'

            '{Role:GlobalAdministrator}'

        )

        ExcludeUsers = @('{BreakGlass}', '{ServiceAccounts}')

    }

    Applications = @{

        Include = @('All')

    }

    Grant = @{

        Operator = 'OR'

        AuthenticationStrength = '{Strength:PhishingResistant}'

    }

}