MT.1036 - All excluded objects should have a fallback include in another policy.
Overview
Checks for gaps in Conditional Access policies, by looking for excluded objects which are not specifically included in another Conditional Access policy. Instead of looking at the historical sign-ins to find gaps, we try to spot possibly overlooked exclusions which do not have a fallback.
Remediation action
Review the configuration described above.
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1036 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Access control |
| Resource type | ConditionalAccessPolicy |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| PowerShell test | Test-MtCaGap |
| Services | Graph |
Source
- Test:
tests/maester/entra/Test.MT.1036.ps1 - Documentation:
tests/maester/entra/Test.MT.1036.md