Rules/CA-002.mfa-for-admins.psd1
|
@{ Id = 'CA-002' Title = 'Administrative roles require MFA' Area = 'ConditionalAccess' Severity = 'Critical' References = @( 'CIS Microsoft 365 Foundations Benchmark (Conditional Access for administrative roles)' 'https://learn.microsoft.com/entra/identity/conditional-access/policy-old-require-mfa-admin' ) Rationale = 'A compromised Global Administrator account without MFA is a full tenant compromise. Admin roles are the highest-value target.' Remediation = 'Create an enabled Conditional Access policy that includes the directory admin roles (at minimum Global Administrator) and requires multifactor authentication or an authentication strength.' Test = { param($Snapshot) $globalAdminTemplateId = '62e90394-69f5-4237-9190-012177145e10' $hits = @($Snapshot.ConditionalAccess | Where-Object { $_.state -eq 'enabled' -and $_.conditions -and $_.conditions.users -and (@($_.conditions.users.includeRoles) -contains $globalAdminTemplateId) -and $_.grantControls -and ( (@($_.grantControls.builtInControls) -contains 'mfa') -or ($_.grantControls.PSObject.Properties['authenticationStrength'] -and $_.grantControls.authenticationStrength) ) }) if ($hits.Count -gt 0) { New-TLRuleResult -Status Pass -Evidence @($hits | ForEach-Object { $_.displayName }) } else { New-TLRuleResult -Status Fail -Evidence 'No enabled Conditional Access policy requires MFA for the Global Administrator role.' } } } |