MT.1001 - At least one Conditional Access policy is configured with device compliance.

Contributed by Merill Fernando with 2 co-contributorsAll contributors →

Overview

Device compliance Conditional Access policy can be used to require devices to be compliant with the tenant's device compliance policy.

Learn more: https://learn.microsoft.com/entra/identity/conditional-access/howto-conditional-access-policy-compliant-device

Remediation action

Review the configuration described above.

Test Metadata

Field	Value
Test ID	MT.1001
Severity	Medium
Suite	Maester
Product	Entra ID
Feature	Conditional Access
Area	Access control
Resource type	Tenant
User impact	Medium
Implementation cost	Medium
MITRE ATT&CK	T1078.004 Cloud Accounts
Supports controls	nist-800-53-r5:AC-2(11), nist-800-53-r5:IA-3
PowerShell test	Test-MtCaDeviceComplianceExists
Services	Graph
Compatible licenses	AAD_PREMIUM

Source

• Test: tests/maester/entra/Test.MT.1001.ps1
• Documentation: tests/maester/entra/Test.MT.1001.md