MT.1035 - All security groups assigned to Conditional Access Policies should be protected by RMAU.

Contributed by Thomas Naunheim with Thomas SchmidtAll contributors →

Overview

Security Groups will be used to exclude and include users from Conditional Access Policies. Modify group membership outside of Conditional Access Administrator or other privileged roles can lead to bypassing Conditional Access Policies.

To prevent this, you can protect these groups by using Restricted Management Administrative Units or Role Assignable Groups. Role Assignable Group should be used in combination of assignments to Entra ID roles. Restricted Management Administrative Units should be used to protect groups by restricting management to specific users or groups. This test checks if all groups used in Conditional Access Policies are protected.

See Restricted management administrative units in Microsoft Entra ID - Microsoft Entra ID | Microsoft Learn

Test Metadata

Field	Value
Test ID	MT.1035
Severity	High
Suite	Maester
Product	Entra ID
Feature	Conditional Access
Area	Privileged access
Resource type	Group
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	T1098 Account Manipulation, T1556.009 Conditional Access Policies
Supports controls	nist-800-53-r5:AC-6, nist-800-53-r5:AC-3
PowerShell test	Test-MtCaGroupsRestricted
Services	Graph
Compatible licenses	AAD_PREMIUM

Source

• Test: tests/maester/entra/Test.MT.1035.ps1
• Documentation: tests/maester/entra/Test.MT.1035.md