Checks

Microsoft Entra admin consent workflow is evaluated to confirm an approval path exists for app permission requests. The check looks for the workflow being enabled and, when present, whether reviewer notifications are configured.

Microsoft Entra Conditional Access restricts MicrosoftAdminPortals by targeting admin portals, including all users, excluding administrative roles, and applying a block decision. The assessment determines whether an active policy enforces this restriction rather than only reporting.

Microsoft Entra administrative users are evaluated to confirm they are cloud-only accounts, with no on-premises directory synchronization for any user holding privileged roles.

Microsoft Entra Conditional Access policies that enforce multifactor authentication for users in administrative roles across all resources.

The assessment identifies at least one active policy that targets admin roles (or all users), includes all applications, and grants access only when Require multifactor authentication is satisfied.

Microsoft Entra Conditional Access for administrator roles requires phishing-resistant MFA authentication strength on All applications. Disabled policies are ignored; report-only policies aren't considered. Policies with custom strengths require review to confirm they are truly phishing-resistant.

Microsoft Entra Conditional Access evaluates whether admin roles are covered by policies that enforce a defined sign-in frequency and non-persistent browser sessions across all cloud apps. It looks for reauthentication set to a time interval or Every time, persistent browser set to never, and policies that are enforced rather than report-only or disabled.

Microsoft Entra Conditional Access has at least one policy configured to target all cloud apps. This ensures comprehensive security coverage and automatic protection for newly onboarded applications without requiring policy updates.

Microsoft Entra application registrations should not have any secret credentials configured. This check audits the current state of every application registration and reports those that hold one or more secrets. Both expired and active secrets are reported, since expired entries are credential clutter that should be cleaned up.

Microsoft Entra ID app registrations are evaluated for credential validity. Each app's password secrets and certificate credentials are checked for expiration. Credentials that are already expired, expiring within 30 days, or have no expiration date are flagged.

Microsoft Entra OAuth app registrations with privileged API permissions (High privilege level) that are not being actively used. Usage status is determined by Microsoft Defender for Cloud Apps App Governance.

The Microsoft Authenticator authentication method should have the Show application name (displayAppInformationRequiredState) and Show geographic location (displayLocationInformationRequiredState) feature settings enabled. This adds context to push and passwordless notifications so users can detect and reject fraudulent approval requests.

Microsoft Entra tenant's authentication methods policy should have the Email OTP authentication method disabled. Email one-time passcodes depend on the security of the recipient mailbox, which is typically a lower-assurance channel, and should not be used as a primary or fallback multi-factor authentication method for members.

Microsoft Entra tenant's authentication methods policy should have SMS and Voice authentication methods disabled. These methods are vulnerable to SIM-swapping, interception, and social engineering attacks, and are deprecated by NIST SP 800-63B as out-of-band authenticators.

Microsoft Entra ID authentication methods policy is evaluated for strong authentication enforcement. The check verifies that at least one strong method (Microsoft Authenticator, FIDO2, or X.509 Certificate) is enabled and that the MFA registration campaign is active to prompt users to enroll.

Microsoft Entra break glass (emergency access) accounts should have at least one FIDO2 security key registered as their authentication method. These accounts are identified as users excluded from all enabled Conditional Access policies.

Helper check that verifies whether Microsoft Entra Conditional Access includes at least one enabled policy scoped to all cloud applications and all users. Policies that only require a password change and report-only policies are excluded from passing. The result is intended to support other, more specific Conditional Access checks rather than enforce a baseline on its own.

Microsoft Entra Conditional Access policy with application enforced restrictions limits access to SharePoint, OneDrive, and Exchange content from unmanaged devices.

This control helps prevent data exfiltration by restricting download, print, and sync capabilities on devices that are not managed by the organization.

Microsoft Entra Conditional Access policies can require that only approved client apps or apps with app protection policies are used on iOS and Android devices. This ensures corporate data on mobile platforms is accessed only through managed or protected applications.

At least one enabled Conditional Access policy should target the authentication transfer flow for all users and all resources and set the grant control to Block. Authentication transfer lets a user move an authenticated session from one device to another (for example, by scanning a QR code), which can be abused to move a session onto an attacker-controlled device.

This check verifies that at least one enabled Conditional Access policy blocks access to all cloud applications for users flagged with an elevated insider risk level by Microsoft Purview Insider Risk Management and Adaptive Protection.

At least one enabled Conditional Access policy should target all users and all resources with the sign-in risk condition set to High and Medium and the grant control set to Block. Microsoft Entra ID Protection evaluates sign-in risk in real time; blocking risky sign-ins prevents access from sessions that are likely not performed by the legitimate account owner.

A Conditional Access policy configured to block Office 365 access for users flagged with elevated insider risk by Microsoft Purview Adaptive Protection.

This control uses behavioral signals to restrict access when a user's risk level indicates potential insider threat activity.

Microsoft Entra Conditional Access can block sign-ins from device platforms that the organization does not recognize or support. A policy that includes all platforms and excludes the known ones (Android, iOS, Windows, macOS, Linux) effectively blocks any unknown or unsupported platform, reducing the attack surface from unmanaged or unexpected devices.

Microsoft Entra Conditional Access policy enforces one of the following grant controls for admin roles or all users across all cloud apps: - 'Require device to be marked as compliant' - 'Require Microsoft Entra hybrid joined device' - 'Require multifactor authentication' This ensures that access is provided only under strong authentication or trusted device conditions.