Checks

At least one enabled Conditional Access policy should target all users and all resources with the sign-in risk condition set to High and Medium and the grant control set to Block. Microsoft Entra ID Protection evaluates sign-in risk in real time; blocking risky sign-ins prevents access from sessions that are likely not performed by the legitimate account owner.

A Conditional Access policy configured to block Office 365 access for users flagged with elevated insider risk by Microsoft Purview Adaptive Protection.

This control uses behavioral signals to restrict access when a user's risk level indicates potential insider threat activity.

Microsoft Entra Conditional Access can block sign-ins from device platforms that the organization does not recognize or support. A policy that includes all platforms and excludes the known ones (Android, iOS, Windows, macOS, Linux) effectively blocks any unknown or unsupported platform, reducing the attack surface from unmanaged or unexpected devices.

Microsoft Entra Conditional Access policy enforces one of the following grant controls for admin roles or all users across all cloud apps: - 'Require device to be marked as compliant' - 'Require Microsoft Entra hybrid joined device' - 'Require multifactor authentication' This ensures that access is provided only under strong authentication or trusted device conditions.

Microsoft Entra Conditional Access policy with sign-in frequency controls how often users must re-authenticate when accessing resources from non-corporate devices.

This ensures that sessions on unmanaged devices are time-limited, reducing the window of opportunity for unauthorized access through stale sessions.

Conditional Access policies restrict the device code authentication flow, which is commonly abused in phishing campaigns to hijack user sessions. A policy targeting deviceCodeFlow in authentication flow conditions with a block grant control prevents this attack vector.

Microsoft Entra Conditional Access policies can require multifactor authentication (MFA) for device registration operations.

This control ensures users must complete MFA before registering or joining devices to the directory, reducing the likelihood that compromised credentials can be used to register rogue devices.

Conditional Access policies scoped to all users and all cloud applications are evaluated to confirm the Directory Synchronization Accounts role is explicitly excluded. The Microsoft Entra Connect Sync Account does not support multifactor authentication, so it must be excluded from restrictive policies to maintain directory synchronization.

Microsoft Entra Conditional Access is verified to have at least one enabled policy that explicitly includes the Azure DevOps cloud application. Policies targeting All cloud apps do not satisfy this check because the goal is to verify that Azure DevOps has been deliberately considered.

Microsoft Entra Conditional Access policies are evaluated for security groups referenced in includeGroups and excludeGroups. Referenced groups must be protected by Restricted Management Administrative Unit membership or configured as role-assignable groups.

An enabled Conditional Access policy enforces Require device to be marked as compliant for all users across all cloud apps with no application exclusions. This check also verifies that Intune has assigned compliance policies and at least one currently reported compliant MDM-managed device. If Graph exposes tenant settings, it also checks secure-by-default evaluation.

Microsoft Entra Conditional Access is verified to have at least one enabled policy that requires multifactor authentication for all guest and external user types across all cloud applications. This includes internal guests, B2B collaboration guests and members, B2B direct connect users, other external users, and service providers.

Every object identifier referenced by any Conditional Access policy under conditions.users (includeUsers, excludeUsers, includeGroups, excludeGroups, includeRoles, excludeRoles) must resolve to an existing Microsoft Entra object. This check audits all Conditional Access policies regardless of state and reports any whose user, group, or role references no longer resolve in the directory.

Verifies that every object excluded from an enabled Microsoft Entra Conditional Access policy (users, groups, roles, or applications) is still included by at least one enabled policy, so the exclusion keeps a compensating control. The Directory Synchronization Accounts role and confirmed emergency access (break glass) accounts are treated as intentional and not reported.

Microsoft Entra Conditional Access is verified to have at least one enabled policy that requires multifactor authentication for the Windows Azure Service Management API, covering Azure Portal, CLI, PowerShell, and IaC tools.

At least one enabled Conditional Access policy should target all users and all resources and enforce a sign-in frequency of 7 days or less. Sign-in frequency defines how long an authenticated session remains valid before the user must reauthenticate. The Microsoft Entra default is a rolling 90-day window, which is too permissive.

At least one enabled Conditional Access policy should enforce Token Protection (the secureSignInSession session control) for targeted users. Token Protection binds sign-in session tokens (such as Primary Refresh Tokens) to the device, reducing the effectiveness of token theft and replay attacks.

At least one enabled Conditional Access policy should target all users and all resources, include all network locations, exclude trusted locations, and set the grant control to Block. This blocks access originating from locations that are not explicitly trusted by the organization.

Conditional Access named locations let an organization define trusted IP ranges that can be referenced by Conditional Access policies. At least one IP-range named location should be marked as Trusted and have at least one IP range defined.

Microsoft Entra ID default app management policy is verified to have the required credential restrictions configured for applications: block password addition, restrict max password lifetime, block custom passwords, and restrict max certificate lifetime.

The tenant device registration policy should not automatically add the Global Administrator role to the local administrators group of a device during the Microsoft Entra join process (azureADJoin.localAdmins.enableGlobalAdmins should be false).

The tenant device registration policy should restrict who can register devices as Microsoft Entra joined to Selected users or None. Allowing all users to join devices increases the number of devices that establish a trust relationship with the tenant.

The tenant device registration policy should enable Microsoft Entra Local Administrator Password Solution (LAPS) (localAdminPassword.isEnabled). LAPS securely manages and rotates the built-in local administrator password on Windows devices and stores it for controlled retrieval.

The tenant device registration policy should limit the maximum number of Microsoft Entra joined or registered devices per user to 10 or less (userDeviceQuota). Once the limit is reached, no additional devices can be added until existing ones are removed.