At least one Conditional Access policy is configured to block other legacy authentication
MT.1009HighEntra IDConditional Access
Part of Maester · Entra ID · Conditional Access · All checks
Invoke-Maester -TestId MT.1009Overview
Section titled “Overview”Legacy authentication is an unsecure method to authenticate. This function checks if the tenant has at least one Conditional Access policy that blocks legacy authentication.
Learn more: https://learn.microsoft.com/entra/identity/conditional-access/howto-conditional-access-policy-block-legacy
Remediation action
Section titled “Remediation action”Review the configuration described above.
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | MT.1009 |
| Severity | High |
| Suite | Maester |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1110 Brute Force |
| Supports controls | nist-800-53-r5:CM-7 |
| PowerShell test | Test-MtCaBlockLegacyOtherAuthentication |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
Section titled “Source”- Test:
tests/maester/entra/Test.MT.1009.ps1 - Documentation:
tests/maester/entra/Test.MT.1009.md