Skip to main content
Version: 2.2.1-preview

MT.1181 - Conditional Access policy is present that blocks high agent risk signins

ExeqZMerill Fernando
Contributed by ExeqZ with Merill FernandoAll contributors →

Overview​

Checks whether your tenant has at least one enabled Conditional Access policy that blocks agent identities detected as high risk.

This check looks for enabled Microsoft Entra (Azure AD) Conditional Access policies that target agent identity with risk levels set to High and enforce a Block grant control. Agents (service or managed identities used by automation or AI) that are flagged as high risk by Entra ID Protection should be prevented from authenticating to prevent potentially compromised AI agents from accessing organizational resources.

Remediation action:​

To remediate, create or update a Conditional Access policy that:

  • Users or agents: all agent identities.
  • Target resources: All resources (formerly 'All cloud apps')
  • Conditions: Agent risk to include high.
  • Uses a grant control that includes the Block action.

Refer to Microsoft documentation when creating policies to ensure correct targeting and scope.

Test Metadata​

FieldValue
Test IDMT.1181
SeverityHigh
SuiteMaester
CategoryCA
PowerShell testTest-MtCaAgentRiskBlockPolicy
TagsCA, Maester, MT.1181

Source​

  • Pester test: tests/Maester/Entra/Test-ConditionalAccessBaseline.Tests.ps1
  • PowerShell source: powershell/public/maester/entra/Test-MtCaAgentRiskBlockPolicy.ps1