MT.1033 - Users should be blocked from using legacy authentication.
Overview
Checks if the Conditional Access Policies for blocking legacy authentication is active and used.
Maester evaluates up to five member users (emergency access accounts excluded) with the Conditional Access What If API and creates one result per user (MT.1033.<n>).
See Block legacy authentication - Microsoft Learn
Remediation action
Create a Conditional Access policy that blocks legacy authentication for all users, excluding your emergency access accounts.
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1033 |
| Severity | High |
| Suite | Maester |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | User |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1110 Brute Force |
| Supports controls | nist-800-53-r5:CM-7 |
| PowerShell test | Test-MtCaWhatIfLegacyAuthenticationBlocked |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
| Runs per instance | Yes, one result per instance from Get-MtCaWhatIfRegularUserInstance |
| Long running | Yes |
Source
- Test:
tests/maester/entra/Test.MT.1033.ps1 - Documentation:
tests/maester/entra/Test.MT.1033.md