MT.1016 - At least one Conditional Access policy is configured to require MFA for guest access.
Overview
This check verifies if there is at least one Conditional Access policy that requires multifactor authentication for all guest accounts.
See Require multifactor authentication for guest access - Microsoft Learn
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1016 |
| Severity | High |
| Suite | Maester |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1110 Brute Force |
| Supports controls | nist-800-53-r5:IA-2(1), nist-800-53-r5:AC-20 |
| PowerShell test | Test-MtCaMfaForGuest |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
- Test:
tests/maester/entra/Test.MT.1016.ps1 - Documentation:
tests/maester/entra/Test.MT.1016.md