Private/Get-NSPConditionalAccessOption.ps1
|
function Get-NSPConditionalAccessOption { <# .SYNOPSIS The per-tenant options that choose between alternative definitions, and their defaults. .DESCRIPTION A definition with Option = '<Name>=<Value>' is deployed only in tenants whose profile sets Options.<Name> to that value (or leaves it at the default). Set with Set-NSPConditionalAccessTenantOption. Each option has a Help line and one per value. Registration: how security-information registration is protected. - TrustedLocations: NSP-BASE-REG-01, registration blocked outside trusted locations unless in the ExternalRegistration group. - TapOutsideTrusted (default since 2026-10-09): NSP-BASE-REG-02, a Temporary Access Pass outside trusted locations. - TapEverywhere: NSP-BASE-REG-03, a Temporary Access Pass everywhere (offices without a static IP address). With TrustedLocations and TapOutsideTrusted, NSP-BASE-REG-04 asks for the user's current MFA at trusted locations; someone with no methods yet may still register there. AdminMfa: what administrators sign in with. - Mfa (default): NSP-ADMIN-MFA-01, any MFA method. - PhishingResistant: NSP-ADMIN-MFA-02, a security key, Windows Hello, or a passkey. ServiceAccountLocations: where service accounts may sign in. - Anywhere (default): no policy. - TrustedOnly: NSP-SVC-LOC-01 blocks them outside trusted locations. RiskPolicies: Entra ID Protection policies (needs Entra ID P2). - Off (default): no policy. - On: NSP-RISK-SIGNIN-01 and NSP-RISK-USER-01. #> [CmdletBinding()] [OutputType([hashtable])] param() @{ Registration = @{ Default = 'TapOutsideTrusted'; Values = @('TrustedLocations', 'TapOutsideTrusted', 'TapEverywhere') Help = 'How people may register MFA methods.' ValueHelp = @{ TrustedLocations = 'At the office with current MFA; blocked elsewhere (NSP-BASE-REG-01, REG-04).' TapOutsideTrusted = 'At the office with current MFA; elsewhere a Temporary Access Pass (NSP-BASE-REG-02, REG-04).' TapEverywhere = 'A Temporary Access Pass to register anywhere; no static office IP (NSP-BASE-REG-03).' } } AdminMfa = @{ Default = 'Mfa'; Values = @('Mfa', 'PhishingResistant') Help = 'What administrators must sign in with.' ValueHelp = @{ Mfa = 'Any MFA method (NSP-ADMIN-MFA-01).' PhishingResistant = 'A security key, Windows Hello, or a passkey (NSP-ADMIN-MFA-02). Only once every admin has one.' } } ServiceAccountLocations = @{ Default = 'Anywhere'; Values = @('Anywhere', 'TrustedOnly') Help = 'Where service accounts may sign in.' ValueHelp = @{ Anywhere = 'No restriction.' TrustedOnly = 'Only from trusted locations (NSP-SVC-LOC-01). Needs a trusted location and service accounts in the profile.' } } RiskPolicies = @{ Default = 'Off'; Values = @('Off', 'On') Help = 'Entra ID Protection risk policies. Needs Entra ID P2.' ValueHelp = @{ Off = 'No risk policies.' On = 'MFA on a risky sign-in, and a password change for a high-risk user (NSP-RISK-SIGNIN-01, NSP-RISK-USER-01).' } } } } |