At least one Conditional Access policy is configured to enforce non persistent browser session for non-corporate devices
MT.1017MediumEntra IDConditional Access
Part of Maester · Entra ID · Conditional Access · All checks
Invoke-Maester -TestId MT.1017Overview
Section titled “Overview”Non persistent browser session Conditional Access policy can be helpful to minimize the risk of data leakage from an unmanaged device.
Learn more: https://aka.ms/CATemplatesBrowserSession
Remediation action
Section titled “Remediation action”Review the configuration described above.
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | MT.1017 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1539 Steal Web Session Cookie, T1550.004 Web Session Cookie |
| Supports controls | nist-800-53-r5:AC-19, nist-800-53-r5:AC-12 |
| PowerShell test | Test-MtCaEnforceNonPersistentBrowserSession |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
Section titled “Source”- Test:
tests/maester/entra/Test.MT.1017.ps1 - Documentation:
tests/maester/entra/Test.MT.1017.md