All excluded objects should have a fallback include in another policy

Contributed by Robbe Van den Daele with 3 co-contributorsAll contributors →

Part of Maester · Entra ID · Conditional Access · All checks

Run this check

Invoke-Maester -TestId MT.1036

Overview

Checks for gaps in Conditional Access policies, by looking for excluded objects which are not specifically included in another Conditional Access policy. Instead of looking at the historical sign-ins to find gaps, we try to spot possibly overlooked exclusions which do not have a fallback.

Remediation action

Review the configuration described above.

Details

Every attribute of this check

Field	Value
Test ID	MT.1036
Severity	Medium
Suite	Maester
Product	Entra ID
Feature	Conditional Access
Area	Access control
Resource type	ConditionalAccessPolicy
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	T1078.004 Cloud Accounts
PowerShell test	Test-MtCaGap
Services	Graph

Source

• Test: tests/maester/entra/Test.MT.1036.ps1
• Documentation: tests/maester/entra/Test.MT.1036.md