MT.1008 - At least one Conditional Access policy is configured to require MFA for Azure management.

Contributed by Fabian Bader with 4 co-contributorsAll contributors →

Overview

MFA for Azure management is a critical security control. This function checks if the tenant has at least one Conditional Access policy requiring multifactor authentication to access Azure management.

Learn more: https://learn.microsoft.com/entra/identity/conditional-access/howto-conditional-access-policy-azure-management

Remediation action

Review the configuration described above.

Test Metadata

Field	Value
Test ID	MT.1008
Severity	High
Suite	Maester
Product	Entra ID
Related products	Azure
Feature	Conditional Access
Area	Privileged access
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1078.004 Cloud Accounts, T1110 Brute Force
Supports controls	nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2)
PowerShell test	Test-MtCaMfaForAdminManagement
Services	Graph
Compatible licenses	AAD_PREMIUM

Source

• Test: tests/maester/entra/Test.MT.1008.ps1
• Documentation: tests/maester/entra/Test.MT.1008.md