MT.1024 - Entra recommendations should be completed.
Overview
Microsoft Entra recommendations help you improve the security posture of your tenant. Maester checks every recommendation that Entra reports for the tenant and creates one result per recommendation (MT.1024.<recommendation>). The severity of each result is the recommendation's priority.
These results are not native Maester checks. The recommendation, its priority, its status and its list of impacted users or apps all come from Entra, so Maester cannot change which accounts a recommendation counts. If a recommendation lists accounts you do not expect, such as disabled, shared or room accounts, that is a question for Microsoft, raised through the feedback option on the recommendation in the Entra admin center.
A recommendation passes when Entra reports it as completed. Recommendations that an administrator has marked as Dismissed are skipped. For the sign-in risk, user risk and admin MFA (adminMFAV2) recommendations, a recommendation whose only impacted resources are the configured emergency access (break-glass) accounts passes.
Remediation action
Open the recommendation in the Microsoft Entra admin center and follow its action steps. If a recommendation does not apply to your tenant, mark it as Dismissed in the Entra admin center; Maester then skips it on the next run.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1024 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Feature | Entra recommendations |
| Area | Infrastructure hardening |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtEntraRecommendation |
| Services | Graph |
| Runs per instance | Yes, one result per instance from Get-MtEntraRecommendationInstance |
Source
- Test:
tests/maester/entra/Test.MT.1024.ps1 - Documentation:
tests/maester/entra/Test.MT.1024.md