TenantLens

1.3.2

Rules/ID-003.security-defaults-coherence.psd1

@{
    Id          = 'ID-003'
    Title       = 'Security defaults and Conditional Access are used coherently'
    Area        = 'AuthorizationPolicy'
    Severity    = 'Medium'
    References  = @(
        'https://learn.microsoft.com/entra/fundamentals/security-defaults'
    )
    Rationale   = 'Security defaults and Conditional Access should not run in parallel (conflicting prompts), but at least one of the two must protect the tenant.'
    Remediation = 'When Conditional Access is in use, disable security defaults. When no Conditional Access policies exist, enable security defaults as the baseline.'
    Test        = {
        param($Snapshot)
        $authArea = $Snapshot.AuthorizationPolicy
        $securityDefaultsOn = [bool]($authArea.securityDefaults -and $authArea.securityDefaults.isEnabled)
        if ($null -eq $Snapshot.PSObject.Properties['ConditionalAccess']) {
            return New-TLRuleResult -Status Manual -Evidence 'Conditional Access area was not collected - correlation with security defaults is not possible.'
        }
        $enabledPolicies = @($Snapshot.ConditionalAccess | Where-Object { $_.state -eq 'enabled' })
        if ($enabledPolicies.Count -gt 0 -and $securityDefaultsOn) {
            return New-TLRuleResult -Status Fail -Evidence 'Security defaults are enabled although Conditional Access policies are active.'
        }
        if ($enabledPolicies.Count -eq 0 -and -not $securityDefaultsOn) {
            return New-TLRuleResult -Status Fail -Evidence 'Neither security defaults nor any enabled Conditional Access policy protects this tenant.'
        }
        if ($securityDefaultsOn) {
            New-TLRuleResult -Status Pass -Evidence 'Security defaults are enabled (no Conditional Access in use).'
        }
        else {
            New-TLRuleResult -Status Pass -Evidence ("Conditional Access is active ({0} enabled policies), security defaults are off." -f $enabledPolicies.Count)
        }
    }
}