At least one Conditional Access policy is configured to require compliant or Entra hybrid joined devices for admins

Contributed by Fabian Bader with 2 co-contributorsAll contributors →

Part of Maester · Entra ID · Conditional Access · All checks

Run this check

Invoke-Maester -TestId MT.1014

Overview

Device compliance Conditional Access policy can be used to require devices to be compliant or hybrid Azure AD joined for admins. This is a good way to prevent AITM attacks.

Learn more: https://aka.ms/CATemplatesAdminDevices

Remediation action

Review the configuration described above.

Details

Every attribute of this check

Field	Value
Test ID	MT.1014
Severity	High
Suite	Maester
Product	Entra ID
Feature	Conditional Access
Area	Privileged access
Resource type	Tenant
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	T1078.004 Cloud Accounts, T1539 Steal Web Session Cookie, T1557 Adversary-in-the-Middle
Supports controls	nist-800-53-r5:IA-3, nist-800-53-r5:AC-2(11)
PowerShell test	Test-MtCaDeviceComplianceAdminsExists
Services	Graph
Compatible licenses	AAD_PREMIUM

Source

• Test: tests/maester/entra/Test.MT.1014.ps1
• Documentation: tests/maester/entra/Test.MT.1014.md