MT.1181 - Conditional Access policy is present that blocks high agent risk sign-ins.

Contributed by ExeqZAll contributors →

Overview

Checks whether your tenant has at least one enabled Conditional Access policy that blocks agent identities detected as high risk.

This check looks for enabled Microsoft Entra (Azure AD) Conditional Access policies that target agent identity with risk levels set to High and enforce a Block grant control. Agents (service or managed identities used by automation or AI) that are flagged as high risk by Entra ID Protection should be prevented from authenticating to prevent potentially compromised AI agents from accessing organizational resources.

Remediation action:

To remediate, create or update a Conditional Access policy that:

• Users or agents: all agent identities.
• Target resources: All resources (formerly 'All cloud apps')
• Conditions: Agent risk to include high.
• Uses a grant control that includes the Block action.

Refer to Microsoft documentation when creating policies to ensure correct targeting and scope.

Related links

• Microsoft doc: https://learn.microsoft.com/entra/identity/conditional-access/policy-agent-block-high-risk

Test Metadata

Field	Value
Test ID	MT.1181
Severity	High
Suite	Maester
Product	Entra ID
Feature	Conditional Access
Area	AI and agents
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1078.004 Cloud Accounts
Supports controls	nist-800-53-r5:AC-2(12), nist-800-53-r5:AC-2(13)
PowerShell test	Test-MtCaAgentRiskBlockPolicy
Services	Graph

Source

• Test: tests/maester/entra/Test.MT.1181.ps1
• Documentation: tests/maester/entra/Test.MT.1181.md