MT.1004 - At least one Conditional Access policy is configured with All Apps and All Users.

Contributed by Merill Fernando with Fabian BaderAll contributors →

Overview

Microsoft recommends creating at least one Conditional Access policy targeting all cloud apps and ideally should be enabled for all users.

Learn more: https://learn.microsoft.com/entra/identity/conditional-access/plan-conditional-access#apply-conditional-access-policies-to-every-app

Remediation action

Review the configuration described above.

Test Metadata

Field	Value
Test ID	MT.1004
Severity	High
Suite	Maester
Product	Entra ID
Feature	Conditional Access
Area	Access control
Resource type	Tenant
User impact	Medium
Implementation cost	Medium
MITRE ATT&CK	T1078.004 Cloud Accounts
PowerShell test	Test-MtCheckMT1004
Services	Graph

Source

• Test: tests/maester/entra/Test.MT.1004.ps1
• Documentation: tests/maester/entra/Test.MT.1004.md