MT.1007 - At least one Conditional Access policy is configured to require MFA for all users.

Contributed by Fabian Bader with 2 co-contributorsAll contributors →

Overview

This test checks if the tenant has at least one Conditional Access policy requiring MFA for all users.

See Require MFA for all users - Microsoft Learn

Test Metadata

Field	Value
Test ID	MT.1007
Severity	High
Suite	Maester
Product	Entra ID
Feature	Conditional Access
Area	Authentication
Resource type	Tenant
User impact	Medium
Implementation cost	Medium
MITRE ATT&CK	T1078.004 Cloud Accounts, T1110 Brute Force
Supports controls	nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2)
PowerShell test	Test-MtCaMfaForAllUsers
Services	Graph
Compatible licenses	AAD_PREMIUM

Source

• Test: tests/maester/entra/Test.MT.1007.ps1
• Documentation: tests/maester/entra/Test.MT.1007.md