TenantLens

1.3.2

Rules/CA-002.mfa-for-admins.psd1

                                @{

    Id          = 'CA-002'

    Title       = 'Administrative roles require MFA'

    Area        = 'ConditionalAccess'

    Severity    = 'Critical'

    References  = @(

        'CIS Microsoft 365 Foundations Benchmark (Conditional Access for administrative roles)'

        'https://learn.microsoft.com/entra/identity/conditional-access/policy-old-require-mfa-admin'

    )

    Rationale   = 'A compromised Global Administrator account without MFA is a full tenant compromise. Admin roles are the highest-value target.'

    Remediation = 'Create an enabled Conditional Access policy that includes the directory admin roles (at minimum Global Administrator) and requires multifactor authentication or an authentication strength.'

    Test        = {

        param($Snapshot)

        $globalAdminTemplateId = '62e90394-69f5-4237-9190-012177145e10'

        $hits = @($Snapshot.ConditionalAccess | Where-Object {

                $_.state -eq 'enabled' -and

                $_.conditions -and $_.conditions.users -and

                (@($_.conditions.users.includeRoles) -contains $globalAdminTemplateId) -and

                $_.grantControls -and (

                    (@($_.grantControls.builtInControls) -contains 'mfa') -or

                    ($_.grantControls.PSObject.Properties['authenticationStrength'] -and $_.grantControls.authenticationStrength)

                )

            })

        if ($hits.Count -gt 0) {

            New-TLRuleResult -Status Pass -Evidence @($hits | ForEach-Object { $_.displayName })

        }

        else {

            New-TLRuleResult -Status Fail -Evidence 'No enabled Conditional Access policy requires MFA for the Global Administrator role.'

        }

    }

}