MT.1012 - At least one Conditional Access policy is configured to require MFA for risky sign-ins.
Overview
Checks if the tenant has at least one Conditional Access policy requiring multifactor authentication for risky sign-ins.
See Sign-in risk-based multifactor authentication - Microsoft Learn
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1012 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1110 Brute Force |
| Supports controls | nist-800-53-r5:AC-2(12), nist-800-53-r5:IA-2(1) |
| PowerShell test | Test-MtCaMfaForRiskySignIn |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM_P2 |
Source
- Test:
tests/maester/entra/Test.MT.1012.ps1 - Documentation:
tests/maester/entra/Test.MT.1012.md