Rules/CA-006.compliant-device-or-mfa.psd1
|
@{ Id = 'CA-006' Title = 'Broad access requires a compliant device or MFA' Area = 'ConditionalAccess' Severity = 'Medium' References = @( 'CIS Microsoft 365 Foundations Benchmark (Conditional Access device compliance)' 'https://learn.microsoft.com/entra/identity/conditional-access/howto-conditional-access-policy-compliant-device' ) Rationale = 'Requiring device compliance (or at least MFA) for all cloud apps prevents access from unmanaged, potentially compromised endpoints.' Remediation = 'Create an enabled Conditional Access policy for all users and all cloud apps that grants access only with a compliant/hybrid-joined device or MFA.' Test = { param($Snapshot) $hits = @($Snapshot.ConditionalAccess | Where-Object { $_.state -eq 'enabled' -and $_.conditions -and $_.conditions.users -and (@($_.conditions.users.includeUsers) -contains 'All') -and $_.conditions.applications -and (@($_.conditions.applications.includeApplications) -contains 'All') -and $_.grantControls -and ( (@($_.grantControls.builtInControls) -contains 'compliantDevice') -or (@($_.grantControls.builtInControls) -contains 'domainJoinedDevice') -or (@($_.grantControls.builtInControls) -contains 'mfa') -or ($_.grantControls.PSObject.Properties['authenticationStrength'] -and $_.grantControls.authenticationStrength) ) }) if ($hits.Count -gt 0) { New-TLRuleResult -Status Pass -Evidence @($hits | ForEach-Object { $_.displayName }) } else { New-TLRuleResult -Status Fail -Evidence 'No enabled policy requires a compliant device or MFA for all users on all cloud apps.' } } } |