NSP.M365.ConditionalAccess

0.1.1

Policies/NSP-ADMIN-MFA-01.psd1

                                @{

    Id = 'NSP-ADMIN-MFA-01'

    Name = 'Require MFA for administrative roles'

    Version = 1

    Description = 'Holders of privileged directory roles must complete MFA at every sign-in.'

    Notes = 'Converted from Legacy/Policies/ADMIN-MFAPolicy.ps1. The legacy bare role template IDs are now named role references.'

    LegacyNames = @('Admin - MFA Policy')

    Option = 'AdminMfa=Mfa'

    DefaultState = 'reportOnly'

    Users = @{

        IncludeRoles = @(

            '{Role:ApplicationAdministrator}'

            '{Role:AuthenticationAdministrator}'

            '{Role:AuthenticationPolicyAdministrator}'

            '{Role:BillingAdministrator}'

            '{Role:CloudApplicationAdministrator}'

            '{Role:ConditionalAccessAdministrator}'

            '{Role:ExchangeAdministrator}'

            '{Role:HelpdeskAdministrator}'

            '{Role:PasswordAdministrator}'

            '{Role:PrivilegedAuthenticationAdministrator}'

            '{Role:PrivilegedRoleAdministrator}'

            '{Role:SecurityAdministrator}'

            '{Role:SharePointAdministrator}'

            '{Role:TeamsAdministrator}'

            '{Role:UserAdministrator}'

            '{Role:GlobalAdministrator}'

        )

        ExcludeUsers = @('{BreakGlass}', '{ServiceAccounts}')

    }

    Applications = @{

        Include = @('All')

    }

    Grant = @{

        Operator = 'OR'

        BuiltInControls = @('mfa')

    }

}