Rules/CA-003.mfa-for-all-users.psd1
|
@{ Id = 'CA-003' Title = 'All users are required to use MFA' Area = 'ConditionalAccess' Severity = 'High' References = @( 'CIS Microsoft 365 Foundations Benchmark (Conditional Access MFA for all users)' 'https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-mfa-strength' ) Rationale = 'MFA blocks the vast majority of account-takeover attacks. Coverage must apply to every user and every cloud app, not only admins.' Remediation = 'Create an enabled Conditional Access policy including all users and all cloud apps that requires multifactor authentication or an authentication strength (exclude only the break-glass accounts).' Test = { param($Snapshot) $hits = @($Snapshot.ConditionalAccess | Where-Object { $_.state -eq 'enabled' -and $_.conditions -and $_.conditions.users -and (@($_.conditions.users.includeUsers) -contains 'All') -and $_.conditions.applications -and (@($_.conditions.applications.includeApplications) -contains 'All') -and $_.grantControls -and ( (@($_.grantControls.builtInControls) -contains 'mfa') -or ($_.grantControls.PSObject.Properties['authenticationStrength'] -and $_.grantControls.authenticationStrength) ) }) if ($hits.Count -gt 0) { New-TLRuleResult -Status Pass -Evidence @($hits | ForEach-Object { $_.displayName }) } else { New-TLRuleResult -Status Fail -Evidence 'No enabled Conditional Access policy requires MFA for all users on all cloud apps.' } } } |