Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion build/aitools/test-metadata/maester-config.json
Original file line number Diff line number Diff line change
Expand Up @@ -984,7 +984,7 @@
},
{
"Id": "MT.1035",
"Title": "All security groups assigned to Conditional Access Policies should be protected by RMAU.",
"Title": "All security groups assigned to Conditional Access policies should be protected by RMAU.",
"Severity": "High"
},
{
Expand Down
10 changes: 5 additions & 5 deletions build/aitools/test-metadata/test-results.json
Original file line number Diff line number Diff line change
Expand Up @@ -7222,7 +7222,7 @@
"ResultDetail": {
"TestTitle": "EIDSCA.AT01: Authentication Method - Temporary Access Pass - State. See https://maester.dev/docs/tests/EIDSCA.AT01",
"TestResult": "\nWell done. The configuration in your tenant and recommended value is **'enabled'** for **policies/authenticationMethodsPolicy/authenticationMethodConfigurations('TemporaryAccessPass')**\n",
"TestDescription": "Whether the Temporary Access Pass is enabled in the tenant.\n\nUse Temporary Access Pass for secure onboarding users (initial password replacement) and enforce MFA for registering security information in Conditional Access Policy.\n\n#### Test script\n```\nhttps://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations('TemporaryAccessPass')\n.state -eq 'enabled'\n```\n\n#### Related links\n\n- [Open in Graph Explorer](https://developer.microsoft.com/en-us/graph/graph-explorer?request=policies/authenticationMethodsPolicy/authenticationMethodConfigurations('TemporaryAccessPass')&method=GET&version=beta&GraphUrl=https://graph.microsoft.com)\n- [temporaryAccessPassAuthenticationMethodConfiguration resource type - Microsoft Graph v1.0 | Microsoft Learn](https://learn.microsoft.com/en-us/graph/api/resources/temporaryaccesspassauthenticationmethodconfiguration)\n\n\n",
"TestDescription": "Whether the Temporary Access Pass is enabled in the tenant.\n\nUse Temporary Access Pass for secure onboarding users (initial password replacement) and enforce MFA for registering security information in Conditional Access policy.\n\n#### Test script\n```\nhttps://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations('TemporaryAccessPass')\n.state -eq 'enabled'\n```\n\n#### Related links\n\n- [Open in Graph Explorer](https://developer.microsoft.com/en-us/graph/graph-explorer?request=policies/authenticationMethodsPolicy/authenticationMethodConfigurations('TemporaryAccessPass')&method=GET&version=beta&GraphUrl=https://graph.microsoft.com)\n- [temporaryAccessPassAuthenticationMethodConfiguration resource type - Microsoft Graph v1.0 | Microsoft Learn](https://learn.microsoft.com/en-us/graph/api/resources/temporaryaccesspassauthenticationmethodconfiguration)\n\n\n",
"SkippedReason": null,
"Severity": "High",
"TestSkipped": "",
Expand Down Expand Up @@ -10238,8 +10238,8 @@
},
{
"Id": "MT.1035",
"Title": "All security groups assigned to Conditional Access Policies should be protected by RMAU.",
"Name": "MT.1035: All security groups assigned to Conditional Access Policies should be protected by RMAU.",
"Title": "All security groups assigned to Conditional Access policies should be protected by RMAU.",
"Name": "MT.1035: All security groups assigned to Conditional Access policies should be protected by RMAU.",
"HelpUrl": "https://maester.dev/docs/tests/MT.1035",
"Tag": [
"Maester",
Expand All @@ -10253,9 +10253,9 @@
"Block": "Maester/Entra",
"Duration": "00:00:00",
"ResultDetail": {
"TestTitle": "MT.1035: All security groups assigned to Conditional Access Policies should be protected by RMAU. See https://maester.dev/docs/tests/MT.1035",
"TestTitle": "MT.1035: All security groups assigned to Conditional Access policies should be protected by RMAU. See https://maester.dev/docs/tests/MT.1035",
"TestResult": "Well done! All security groups with assignment in Conditional Access are protected.",
"TestDescription": "Security Groups will be used to exclude and include users from Conditional Access Policies. Modify group membership outside of Conditional Access Administrator or other privileged roles can lead to bypassing Conditional Access Policies.\n\nTo prevent this, you can protect these groups by using Restricted Management Administrative Units or Role Assignable Groups. Role Assignable Group should be used in combination of assignments to Entra ID roles. Restricted Management Administrative Units should be used to protect groups by restricting management to specific users or groups. This test checks if all groups used in Conditional Access Policies are protected.\n\nSee [Restricted management administrative units in Microsoft Entra ID - Microsoft Entra ID | Microsoft Learn](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/admin-units-restricted-management)",
"TestDescription": "Security Groups will be used to exclude and include users from Conditional Access policies. Modify group membership outside of Conditional Access Administrator or other privileged roles can lead to bypassing Conditional Access policies.\n\nTo prevent this, you can protect these groups by using Restricted Management Administrative Units or Role Assignable Groups. Role Assignable Group should be used in combination of assignments to Entra ID roles. Restricted Management Administrative Units should be used to protect groups by restricting management to specific users or groups. This test checks if all groups used in Conditional Access policies are protected.\n\nSee [Restricted management administrative units in Microsoft Entra ID - Microsoft Entra ID | Microsoft Learn](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/admin-units-restricted-management)",
"SkippedReason": null,
"Severity": "",
"TestSkipped": "",
Expand Down
Loading
Loading