TenantLens

1.3.2

Rules/CA-009.no-ineffective-policies.psd1

@{
    Id          = 'CA-009'
    Title       = 'No enabled Conditional Access policy is ineffective'
    Area        = 'ConditionalAccess'
    Severity    = 'Low'
    References  = @(
        'https://learn.microsoft.com/entra/identity/conditional-access/plan-conditional-access'
    )
    Rationale   = 'An enabled policy without any grant or session control evaluates users, logs decisions - and enforces nothing. It suggests protection that does not exist.'
    Remediation = 'Add the intended grant/session controls to the flagged policies or delete them.'
    Test        = {
        param($Snapshot)
        $ineffective = @($Snapshot.ConditionalAccess | Where-Object {
                $_.state -eq 'enabled' -and
                (
                    -not $_.grantControls -or (
                        @($_.grantControls.builtInControls).Count -eq 0 -and
                        -not ($_.grantControls.PSObject.Properties['authenticationStrength'] -and $_.grantControls.authenticationStrength)
                    )
                ) -and
                (
                    -not $_.PSObject.Properties['sessionControls'] -or -not $_.sessionControls -or
                    @($_.sessionControls.PSObject.Properties | Where-Object { $null -ne $_.Value -and $_.Name -notlike '@*' }).Count -eq 0
                )
            })
        if ($ineffective.Count -gt 0) {
            New-TLRuleResult -Status Fail -Evidence @($ineffective | ForEach-Object { $_.displayName })
        }
        else {
            New-TLRuleResult -Status Pass -Evidence 'Every enabled policy carries at least one grant or session control.'
        }
    }
}