Rules/CA-001.legacy-auth-blocked.psd1
|
@{ Id = 'CA-001' Title = 'Legacy authentication is blocked by Conditional Access' Area = 'ConditionalAccess' Severity = 'High' References = @( 'CIS Microsoft 365 Foundations Benchmark 5.2.2.3' 'https://learn.microsoft.com/entra/identity/conditional-access/policy-block-legacy-authentication' ) Rationale = 'Legacy protocols (IMAP, POP, SMTP AUTH, Exchange ActiveSync basic auth) bypass MFA entirely and are the most common password-spray entry point.' Remediation = 'Create an enabled Conditional Access policy targeting client app types "Exchange ActiveSync clients" and "Other clients" with grant control "Block access".' Test = { param($Snapshot) $blockers = @($Snapshot.ConditionalAccess | Where-Object { $_.state -eq 'enabled' -and $_.conditions -and $_.conditions.clientAppTypes -and (@($_.conditions.clientAppTypes) -contains 'other') -and $_.grantControls -and (@($_.grantControls.builtInControls) -contains 'block') }) if ($blockers.Count -gt 0) { New-TLRuleResult -Status Pass -Evidence @($blockers | ForEach-Object { $_.displayName }) } else { New-TLRuleResult -Status Fail -Evidence 'No enabled Conditional Access policy blocks legacy authentication client apps.' } } } |