MT.1009 - At least one Conditional Access policy is configured to block other legacy authentication.
Overview
Legacy authentication is an unsecure method to authenticate. This function checks if the tenant has at least one Conditional Access policy that blocks legacy authentication.
Learn more: https://learn.microsoft.com/entra/identity/conditional-access/howto-conditional-access-policy-block-legacy
Remediation action
Review the configuration described above.
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1009 |
| Severity | High |
| Suite | Maester |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1110 Brute Force |
| Supports controls | nist-800-53-r5:CM-7 |
| PowerShell test | Test-MtCaBlockLegacyOtherAuthentication |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
- Test:
tests/maester/entra/Test.MT.1009.ps1 - Documentation:
tests/maester/entra/Test.MT.1009.md