Policies/NSP-INTUNE-MFA-03.psd1
|
@{ Id = 'NSP-INTUNE-MFA-03' Name = 'Sign in with MFA every time to enroll a device in Intune' Version = 1 Description = 'Enrolling any device (Windows, macOS, Android, iOS) through Microsoft Intune Enrollment requires MFA at that moment, not from a remembered session.' Notes = 'New with the module (2026-10-09), from the common baselines. Widens NSP-INTUNE-MFA-01 (Android and iOS, any MFA session) to every platform, with a fresh sign-in; NSP-INTUNE-MFA-01 keeps its legacy shape for parity.' DefaultState = 'reportOnly' Users = @{ IncludeUsers = @('All') ExcludeUsers = @('{BreakGlass}', '{ServiceAccounts}') } Applications = @{ Include = @('{App:Microsoft Intune Enrollment}') } Grant = @{ Operator = 'OR' BuiltInControls = @('mfa') } Session = @{ SignInFrequency = @{ EveryTime = $true } } } |