At least one Conditional Access policy is configured to require MFA for guest access

Contributed by Fabian Bader with 2 co-contributorsAll contributors →

Part of Maester · Entra ID · Conditional Access · All checks

Run this check

Invoke-Maester -TestId MT.1016

Overview

This check verifies if there is at least one Conditional Access policy that requires multifactor authentication for all guest accounts.

See Require multifactor authentication for guest access - Microsoft Learn

Details

Every attribute of this check

Field	Value
Test ID	MT.1016
Severity	High
Suite	Maester
Product	Entra ID
Feature	Conditional Access
Area	Authentication
Resource type	Tenant
User impact	Medium
Implementation cost	Low
MITRE ATT&CK	T1078.004 Cloud Accounts, T1110 Brute Force
Supports controls	nist-800-53-r5:IA-2(1), nist-800-53-r5:AC-20
PowerShell test	Test-MtCaMfaForGuest
Services	Graph
Compatible licenses	AAD_PREMIUM

Source

• Test: tests/maester/entra/Test.MT.1016.ps1
• Documentation: tests/maester/entra/Test.MT.1016.md