Policies/NSP-BASE-REG-01.psd1
|
@{ Id = 'NSP-BASE-REG-01' Name = 'Block security-information registration outside trusted locations' Version = 2 Description = 'Registering or changing security information (MFA methods) is blocked outside trusted locations. Members of the ExternalRegistration group are exempt, for supervised remote cases such as replacing a phone.' Notes = 'Converted from Legacy/Policies/BASE_RegisterSecurityInfo_OnlyTrusted.ps1. Version 2 (2026-10-09) blocks instead of requiring MFA: an adversary-in-the-middle attacker holds a session that already passed MFA and could register their own method from anywhere. The legacy MFA grant is recorded as a parity divergence.' LegacyNames = @('Register Security Information - ONLY trusted locations') DefaultState = 'reportOnly' Option = 'Registration=TrustedLocations' Users = @{ IncludeUsers = @('All') ExcludeUsers = @('{BreakGlass}', '{ServiceAccounts}') ExcludeGroups = @('{Group:ExternalRegistration}') } Applications = @{ UserActions = @('urn:user:registersecurityinfo') } Locations = @{ Include = @('All') Exclude = @('AllTrusted') } Grant = @{ Operator = 'OR' BuiltInControls = @('block') } } |