Policies/NSP-BASE-REG-03.psd1
|
@{ Id = 'NSP-BASE-REG-03' Name = 'Temporary Access Pass to register security information' Version = 2 Description = 'Registering security information anywhere requires a Temporary Access Pass (one-time or multi-use), issued by the helpdesk, used in that sign-in. For tenants whose offices have no static IP address to trust (Registration = TapEverywhere).' Notes = 'New with the module (2026-10-01). Users who already have MFA also need a Temporary Access Pass to add or change a method. Requires the Temporary Access Pass method to be enabled; the preflight checks it. Version 2 (2026-10-09): sign in every time, so a session that once used a Temporary Access Pass cannot be replayed later to register.' Option = 'Registration=TapEverywhere' DefaultState = 'reportOnly' Users = @{ IncludeUsers = @('All') ExcludeUsers = @('{BreakGlass}', '{ServiceAccounts}') } Applications = @{ UserActions = @('urn:user:registersecurityinfo') } Grant = @{ Operator = 'OR' AuthenticationStrength = '{Strength:TapOnly}' } Session = @{ SignInFrequency = @{ EveryTime = $true } } } |