MT.1013 - At least one Conditional Access policy is configured to require new password when user risk is high.
Overview
Checks if the tenant has at least one Conditional Access policy requiring password change for high user risk.
See User risk-based password change - Microsoft Learn
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1013 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports controls | nist-800-53-r5:AC-2(12), nist-800-53-r5:IA-5 |
| PowerShell test | Test-MtCaRequirePasswordChangeForHighUserRisk |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM_P2 |
Source
- Test:
tests/maester/entra/Test.MT.1013.ps1 - Documentation:
tests/maester/entra/Test.MT.1013.md