MT.1049 - Conditional Access policies for User Risk and Sign-in Risk should be configured separately.
Overview
Checks if both user risk and sign-in risk are configured in one Conditional Access policy.
Combining sign in risk and user risk in one policy will only block access if both types of risk are flagged for a given sign in.
This means if only one type of risk is present (eg Sign-in risk = High, User risk = None), the sign-in will be allowed to proceed. This could create a security gap since risky activities might slip through.
See Sign-in risk-based multifactor authentication - Microsoft Learn
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1049 |
| Severity | High |
| Suite | Maester |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Access control |
| Resource type | ConditionalAccessPolicy |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports controls | nist-800-53-r5:AC-2(12) |
| PowerShell test | Test-MtCheckMT1049 |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM_P2 |
Source
- Test:
tests/maester/entra/Test.MT.1049.ps1 - Documentation:
tests/maester/entra/Test.MT.1049.md