Rules/CA-008.risk-based-policies.psd1
|
@{ Id = 'CA-008' Title = 'Risk-based Conditional Access policies are in place' Area = 'ConditionalAccess' Severity = 'Medium' References = @( 'https://learn.microsoft.com/entra/id-protection/howto-identity-protection-configure-risk-policies' ) Rationale = 'Entra ID P2 risk signals (leaked credentials, anomalous sign-ins) only protect the tenant when a Conditional Access policy actually acts on sign-in or user risk.' Remediation = 'Create Conditional Access policies for high sign-in risk (require MFA or block) and high user risk (require password change or block).' Test = { param($Snapshot) $riskPolicies = @($Snapshot.ConditionalAccess | Where-Object { $_.state -eq 'enabled' -and $_.conditions -and ( ($_.conditions.PSObject.Properties['signInRiskLevels'] -and @($_.conditions.signInRiskLevels).Count -gt 0) -or ($_.conditions.PSObject.Properties['userRiskLevels'] -and @($_.conditions.userRiskLevels).Count -gt 0) ) }) if ($riskPolicies.Count -gt 0) { return New-TLRuleResult -Status Pass -Evidence @($riskPolicies | ForEach-Object { $_.displayName }) } # Without P2 there is nothing to act on - manual review instead of a hard fail. $hasP2 = $false if ($null -ne $Snapshot.PSObject.Properties['TenantBasics']) { $p2Skus = @($Snapshot.TenantBasics.skus | Where-Object { [string]$_.skuPartNumber -match '(?i)(AAD_PREMIUM_P2|EMSPREMIUM|SPE_E5|IDENTITY_THREAT_PROTECTION)' }) $hasP2 = $p2Skus.Count -gt 0 } if ($hasP2) { New-TLRuleResult -Status Fail -Evidence 'Entra ID P2 is licensed but no enabled Conditional Access policy reacts to sign-in or user risk.' } else { New-TLRuleResult -Status Manual -Evidence 'No risk-based policies found and no Entra ID P2 license detected - risk policies require P2.' } } } |