MT.1006 - At least one Conditional Access policy is configured to require MFA for admins.
Overview
This test checks if the tenant has at least one Conditional Access policy requiring MFA for admins. The following roles are considered as admin roles:
- Global Administrator
- Application Administrator
- Authentication Administrator
- Billing Administrator
- Cloud Application Administrator
- Conditional Access Administrator
- Exchange Administrator
- Helpdesk Administrator
- Password Administrator
- Privileged Authentication Administrator
- Privileged Role Administrator
- Security Administrator
- SharePoint Administrator
- User Administrator
See Require MFA for administrators - Microsoft Learn"
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1006 |
| Severity | High |
| Suite | Maester |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Privileged access |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1110 Brute Force |
| Supports controls | nist-800-53-r5:IA-2(1) |
| PowerShell test | Test-MtCaMfaForAdmin |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
- Test:
tests/maester/entra/Test.MT.1006.ps1 - Documentation:
tests/maester/entra/Test.MT.1006.md