EIDSCA.AP05 - Default Authorization Settings - Sign-up for email based subscription.

Contributed by Thomas NaunheimAll contributors →

Overview

Indicates whether users can sign up for email based subscriptions.

Test script

https://graph.microsoft.com/beta/policies/authorizationPolicy
.allowedToSignUpEmailBasedSubscriptions -eq 'false'

Remediation action

Microsoft Graph PowerShell: Update-MgPolicyAuthorizationPolicy -AllowedToSignupEmailBasedSubscriptions $false

Related links

• Open in Graph Explorer
• authorizationPolicy resource type - Microsoft Graph beta | Microsoft Learn

MITRE ATT&CK

Tactic	Technique	Mitigation
TA0001 - Initial Access - Initial Access

Test Metadata

Field	Value
Test ID	EIDSCA.AP05
Severity	Medium
Suite	Entra ID SCA
Product	Entra ID
Feature	User and directory settings
Area	Access control
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	None
PowerShell test	Test-MtCheckEidscaAP05
Services	Graph

Source

• Test: tests/eidsca/Test.EIDSCA.AP05.ps1
• Documentation: tests/eidsca/Test.EIDSCA.AP05.md