Rules/MFA-001.registration-coverage.psd1
|
@{ Id = 'MFA-001' Title = 'At least 95 percent of users are registered for MFA' Area = 'MfaRegistration' Severity = 'Medium' References = @( 'CIS Microsoft 365 Foundations Benchmark (MFA registration)' 'https://learn.microsoft.com/entra/identity/authentication/howto-authentication-methods-activity' ) Rationale = 'A Conditional Access MFA requirement only protects users who are actually registered. Unregistered users are the gap attackers register their own method into.' Remediation = 'Run a registration campaign, enforce registration via Conditional Access or Identity Protection, and follow up on the unregistered accounts (especially admins).' Test = { param($Snapshot) $summary = $Snapshot.MfaRegistration.summary $percent = [double]$summary.registeredPercent $detail = "{0} of {1} users registered ({2}%)" -f $summary.mfaRegistered, $summary.totalUsers, $percent if ([int]$summary.adminsWithoutMfa -gt 0) { $detail += "; {0} admin(s) without MFA" -f $summary.adminsWithoutMfa } if ($percent -ge 95 -and [int]$summary.adminsWithoutMfa -eq 0) { New-TLRuleResult -Status Pass -Evidence $detail } else { New-TLRuleResult -Status Fail -Evidence $detail } } } |