Policies/NSP-BASE-REG-04.psd1
|
@{ Id = 'NSP-BASE-REG-04' Name = 'Require MFA to register security information at trusted locations' Version = 1 Description = 'At trusted locations, registering or changing security information requires the user''s current MFA (or a Temporary Access Pass). Someone with no methods yet (a new user, or after "Require re-register MFA") can still register there. Goes with NSP-BASE-REG-01 or NSP-BASE-REG-02, which cover everywhere else.' Notes = 'New with the module (2026-10-09). Closes the office half: without it, anyone with a user''s password on the office network could change their MFA methods. The behavior for users with no methods follows the user''s experience with this setup; confirm it in the dev tenant.' Option = 'Registration=TrustedLocations,TapOutsideTrusted' DefaultState = 'reportOnly' Users = @{ IncludeUsers = @('All') ExcludeUsers = @('{BreakGlass}', '{ServiceAccounts}') } Applications = @{ UserActions = @('urn:user:registersecurityinfo') } Locations = @{ Include = @('AllTrusted') } Grant = @{ Operator = 'OR' BuiltInControls = @('mfa') } } |