Policies/NSP-BASE-REG-02.psd1
|
@{ Id = 'NSP-BASE-REG-02' Name = 'Temporary Access Pass to register security information outside trusted locations' Version = 2 Description = 'Registering security information from outside trusted locations requires a Temporary Access Pass (one-time or multi-use), issued by the helpdesk, used in that sign-in. On the trusted network, NSP-BASE-REG-04 asks for the user''s current MFA. The default registration mode (Registration = TapOutsideTrusted).' Notes = 'New with the module (2026-10-01). Requires the Temporary Access Pass method to be enabled; the preflight checks it. Version 2 (2026-10-09): sign in every time, so a session that once used a Temporary Access Pass cannot be replayed later to register.' Option = 'Registration=TapOutsideTrusted' DefaultState = 'reportOnly' Users = @{ IncludeUsers = @('All') ExcludeUsers = @('{BreakGlass}', '{ServiceAccounts}') } Applications = @{ UserActions = @('urn:user:registersecurityinfo') } Locations = @{ Include = @('All') Exclude = @('AllTrusted') } Grant = @{ Operator = 'OR' AuthenticationStrength = '{Strength:TapOnly}' } Session = @{ SignInFrequency = @{ EveryTime = $true } } } |