Rules/AUTH-001.weak-methods-disabled.psd1
|
@{ Id = 'AUTH-001' Title = 'Weak authentication methods (SMS, voice) are disabled' Area = 'AuthMethods' Severity = 'Low' References = @( 'https://learn.microsoft.com/entra/identity/authentication/concept-authentication-methods' ) Rationale = 'SMS and voice calls are vulnerable to SIM swapping and social engineering. Phishing-resistant or app-based methods should replace them.' Remediation = 'Disable SMS and voice call methods in the authentication methods policy and migrate the affected users to Microsoft Authenticator, FIDO2 or passkeys.' Test = { param($Snapshot) $methodPolicy = $Snapshot.AuthMethods if (-not $methodPolicy -or -not $methodPolicy.PSObject.Properties['authenticationMethodConfigurations']) { return New-TLRuleResult -Status Manual -Evidence 'Authentication method configurations not present in the snapshot.' } $weakEnabled = @($methodPolicy.authenticationMethodConfigurations | Where-Object { (@('Sms', 'Voice') -contains [string]$_.id) -and ([string]$_.state -eq 'enabled') }) if ($weakEnabled.Count -gt 0) { New-TLRuleResult -Status Fail -Evidence @($weakEnabled | ForEach-Object { "$($_.id) is enabled" }) } else { New-TLRuleResult -Status Pass -Evidence 'SMS and voice call authentication are disabled.' } } } |