EIDSCA.AG03 - Authentication Method - General Settings - Report suspicious activity - Included users/groups.
Overview
Object Id or scope of users which will be included to report suspicious activities if they receive an authentication request that they did not initiate.
Apply this feature to all users.
Test script
https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy
.reportSuspiciousActivitySettings.includeTarget.id -eq 'all_users'
Remediation action
Microsoft Learn - Report suspicious activites
Related links
- Open in Graph Explorer
- Get authenticationMethodsPolicy - Microsoft Graph v1.0 | Microsoft Learn
- View in Microsoft Entra admin center
Test Metadata
| Field | Value |
|---|---|
| Test ID | EIDSCA.AG03 |
| Severity | Medium |
| Suite | Entra ID SCA |
| Product | Entra ID |
| Feature | Authentication methods |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1621 Multi-Factor Authentication Request Generation, T1078.004 Cloud Accounts |
| PowerShell test | Test-MtCheckEidscaAG03 |
| Services | Graph |
Source
- Test:
tests/eidsca/Test.EIDSCA.AG03.ps1 - Documentation:
tests/eidsca/Test.EIDSCA.AG03.md