TenantLens

1.2.0

Rules/AUTH-002.registration-campaign.psd1

@{
    Id          = 'AUTH-002'
    Title       = 'The MFA registration campaign is not disabled'
    Area        = 'AuthMethods'
    Severity    = 'Low'
    References  = @(
        'https://learn.microsoft.com/entra/identity/authentication/how-to-mfa-registration-campaign'
    )
    Rationale   = 'The registration campaign nudges users into Microsoft Authenticator at sign-in - the cheapest lever to close the MFA registration gap without a help-desk project.'
    Remediation = 'Enable the registration campaign (authentication methods policy > registration campaign) or leave it on Microsoft-managed.'
    Test        = {
        param($Snapshot)
        $methodPolicy = $Snapshot.AuthMethods
        $campaign = $null
        if ($methodPolicy.PSObject.Properties['registrationEnforcement'] -and $methodPolicy.registrationEnforcement -and
            $methodPolicy.registrationEnforcement.PSObject.Properties['authenticationMethodsRegistrationCampaign']) {
            $campaign = $methodPolicy.registrationEnforcement.authenticationMethodsRegistrationCampaign
        }
        if (-not $campaign -or -not $campaign.PSObject.Properties['state']) {
            return New-TLRuleResult -Status Manual -Evidence 'Registration campaign state not present in the snapshot.'
        }
        $state = [string]$campaign.state
        if ($state -eq 'disabled') {
            New-TLRuleResult -Status Fail -Evidence 'The MFA registration campaign is disabled.'
        }
        else {
            New-TLRuleResult -Status Pass -Evidence ("Registration campaign state: {0}." -f $state)
        }
    }
}