Policies/NSP-BASE-DEVREG-01.psd1
|
@{ Id = 'NSP-BASE-DEVREG-01' Name = 'Require MFA to register or join a device' Version = 1 Description = 'Registering or joining a device to Entra ID requires MFA, so a stolen password cannot add an attacker''s device.' Notes = 'New with the module (2026-10-09), from the common baselines. Microsoft: set Entra ID > Devices > Device settings > "Require Multifactor Authentication to register or join devices" to No, or this policy is not enforced properly. The tool does not read that setting yet.' DefaultState = 'reportOnly' Users = @{ IncludeUsers = @('All') ExcludeUsers = @('{BreakGlass}', '{ServiceAccounts}') } Applications = @{ UserActions = @('urn:user:registerdevice') } Grant = @{ Operator = 'OR' BuiltInControls = @('mfa') } } |