Entra ID Security Config Analyzer Tests
These tests are based on the Entra ID Security Config Analyzer and verify Microsoft Entra mitigations for common identity attack scenarios. They are generated from the EIDSCA config; the EIDSCA sync page shows how and compares Maester with it.
47 checks17 High21 Medium8 Low1 Info
Run these
Invoke-Maester -Suite eidscaEIDSCA.AF01Authentication Method - FIDO2 security key - State.
Entra ID
Authentication methodsAuthenticationHighLowLowT1566.002nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2)Entra ID SCA (EIDSCA)EIDSCA.AF02Authentication Method - FIDO2 security key - Allow self-service set up.Entra IDAuthentication methodsAuthenticationHighLowLowT1566.002—Entra ID SCA (EIDSCA)EIDSCA.AF03Authentication Method - FIDO2 security key - Enforce attestation.Entra IDAuthentication methodsAuthenticationHighLowLowT1098.005nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.AM01Authentication Method - Microsoft Authenticator - State.Entra IDAuthentication methodsAuthenticationHighLowLowT1110nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2)Entra ID SCA (EIDSCA)EIDSCA.AM03Authentication Method - Microsoft Authenticator - Require number matching for push notifications.Entra IDAuthentication methodsAuthenticationHighLowLowT1621nist-800-53-r5:IA-2(8), nist-800-53-r5:IA-2(1)Entra ID SCA (EIDSCA)EIDSCA.AM04Authentication Method - Microsoft Authenticator - Included users/groups of number matching for push notifications.Entra IDAuthentication methodsAuthenticationHighLowLowT1621nist-800-53-r5:IA-2(8), nist-800-53-r5:IA-2(1)Entra ID SCA (EIDSCA)EIDSCA.AP01Default Authorization Settings - Enabled Self service password reset for administrators.Entra ID
User and directory settingsPrivileged accessHighLowLowT1098nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.AP08Default Authorization Settings - User consent assignments match the restricted or Microsoft recommended baseline.Entra ID
App consent and permissionsApplications and workload identitiesHighMediumLowT1528, T1566.002nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5Entra ID SCA (EIDSCA)EIDSCA.AP09Default Authorization Settings - Allow user consent on risk-based apps.Entra IDApp consent and permissionsApplications and workload identitiesHighLowLowT1528, T1566.002nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5Entra ID SCA (EIDSCA)EIDSCA.AS04Authentication Method - SMS - Use for sign-in.Entra IDAuthentication methodsAuthenticationHighLowLowT1111, T1566.002nist-800-53-r5:CM-7, nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.AV01Authentication Method - Voice call - State.Entra IDAuthentication methodsAuthenticationHighMediumMediumT1621nist-800-53-r5:CM-7, nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.CP01Default Settings - Consent Policy Settings - Group owner consent for apps accessing data.Entra IDApp consent and permissionsApplications and workload identitiesHighLowLowT1528, T1566.002nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5Entra ID SCA (EIDSCA)EIDSCA.CP03Default Settings - Consent Policy Settings - Block user consent for risky apps.Entra IDApp consent and permissionsApplications and workload identitiesHighLowLowT1528, T1566.002nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5Entra ID SCA (EIDSCA)EIDSCA.CP04Default Settings - Consent Policy Settings - Users can request admin consent to apps they are unable to consent to.Entra IDApp consent and permissionsApplications and workload identitiesHighLowLowT1528, T1566.002nist-800-53-r5:CM-4Entra ID SCA (EIDSCA)EIDSCA.CR01Consent Framework - Admin Consent Request - Policy to enable or disable admin consent request feature.Entra IDApp consent and permissionsApplications and workload identitiesHighLowLowT1528, T1566.002nist-800-53-r5:CM-4Entra ID SCA (EIDSCA)EIDSCA.PR01Default Settings - Password Rule Settings - Password Protection - Mode.Entra ID
Password protectionAuthenticationHighLowLowT1110nist-800-53-r5:IA-5(1)Entra ID SCA (EIDSCA)EIDSCA.PR02Default Settings - Password Rule Settings - Password Protection - Enable password protection on Windows Server Active Directory.Entra IDPassword protectionAuthenticationHighLowLowT1110nist-800-53-r5:IA-5(1)Entra ID SCA (EIDSCA)EIDSCA.AF06Authentication Method - FIDO2 security key - Restrict specific keys.Entra IDAuthentication methodsAuthenticationMediumLowLowT1098.005nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.AG02Authentication Method - General Settings - Report suspicious activity - State.Entra IDAuthentication methodsAuthenticationMediumLowLowT1621, T1078.004nist-800-53-r5:SI-4(5)Entra ID SCA (EIDSCA)EIDSCA.AG03Authentication Method - General Settings - Report suspicious activity - Included users/groups.Entra IDAuthentication methodsAuthenticationMediumLowLowT1621, T1078.004—Entra ID SCA (EIDSCA)EIDSCA.AM02Authentication Method - Microsoft Authenticator - Allow use of Microsoft Authenticator OTP.Entra IDAuthentication methodsAuthenticationMediumMediumLowT1566.002—Entra ID SCA (EIDSCA)EIDSCA.AM06Authentication Method - Microsoft Authenticator - Show application name in push and passwordless notifications.Entra IDAuthentication methodsAuthenticationMediumLowLowT1621nist-800-53-r5:IA-2(13), nist-800-53-r5:IA-2(1)Entra ID SCA (EIDSCA)EIDSCA.AM07Authentication Method - Microsoft Authenticator - Included users/groups to show application name in push and passwordless notifications.Entra IDAuthentication methodsAuthenticationMediumLowLowT1621nist-800-53-r5:IA-2(13), nist-800-53-r5:IA-2(1)Entra ID SCA (EIDSCA)EIDSCA.AM09Authentication Method - Microsoft Authenticator - Show geographic location in push and passwordless notifications.Entra IDAuthentication methodsAuthenticationMediumLowLowT1621nist-800-53-r5:IA-2(13), nist-800-53-r5:IA-2(1)Entra ID SCA (EIDSCA)EIDSCA.AM10Authentication Method - Microsoft Authenticator - Included users/groups to show geographic location in push and passwordless notifications.Entra IDAuthentication methodsAuthenticationMediumLowLowT1621nist-800-53-r5:IA-2(13), nist-800-53-r5:IA-2(1)Entra ID SCA (EIDSCA)EIDSCA.AP04Default Authorization Settings - Guest invite restrictions.Entra ID
External identitiesExternal access and sharingMediumMediumLowT1136.003nist-800-53-r5:AC-6(10)Entra ID SCA (EIDSCA)EIDSCA.AP05Default Authorization Settings - Sign-up for email based subscription.Entra IDUser and directory settingsAccess controlMediumLowLow——Entra ID SCA (EIDSCA)EIDSCA.AP06Default Authorization Settings - User can join the tenant by email validation.Entra IDUser and directory settingsAccess controlMediumLowLowT1136.003nist-800-53-r5:AC-2Entra ID SCA (EIDSCA)EIDSCA.AP07Default Authorization Settings - Guest user access.Entra IDExternal identitiesExternal access and sharingMediumLowLowT1087.004, T1069.003nist-800-53-r5:AC-6Entra ID SCA (EIDSCA)EIDSCA.AP10Default Authorization Settings - Default User Role Permissions - Allowed to create Apps.Entra IDUser and directory settingsApplications and workload identitiesMediumLowLowT1098.001, T1528nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5Entra ID SCA (EIDSCA)EIDSCA.AP12Default Authorization Settings - Default User Role Permissions - Allowed to create Tenants.New in 3.0Entra IDUser and directory settingsAccess controlMediumLowLow—nist-800-53-r5:AC-6, nist-800-53-r5:CM-7Entra ID SCA (EIDSCA)EIDSCA.AP15Default Authorization Settings - Default User Role Permissions - Allowed to create agent identity blueprints.New in 3.0Entra ID
Agent identitiesAI and agentsMediumLowLowT1136.003nist-800-53-r5:AC-6Entra ID SCA (EIDSCA)EIDSCA.AT01Authentication Method - Temporary Access Pass - State.Entra IDAuthentication methodsAuthenticationMediumLowLow——Entra ID SCA (EIDSCA)EIDSCA.AT02Authentication Method - Temporary Access Pass - One-time.Entra IDAuthentication methodsAuthenticationMediumLowLowT1078.004nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.PR03Default Settings - Password Rule Settings - Enforce custom list.Entra IDPassword protectionAuthenticationMediumLowLowT1110nist-800-53-r5:IA-5(1)Entra ID SCA (EIDSCA)EIDSCA.PR05Default Settings - Password Rule Settings - Smart Lockout - Lockout duration in seconds.Entra IDPassword protectionAuthenticationMediumLowLowT1110nist-800-53-r5:AC-7Entra ID SCA (EIDSCA)EIDSCA.PR06Default Settings - Password Rule Settings - Smart Lockout - Lockout threshold.Entra IDPassword protectionAuthenticationMediumLowLowT1110nist-800-53-r5:AC-7Entra ID SCA (EIDSCA)EIDSCA.ST08Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to become Group Owner.Entra ID
GroupsExternal access and sharingMediumLowLowT1098nist-800-53-r5:AC-6Entra ID SCA (EIDSCA)EIDSCA.AF04Authentication Method - FIDO2 security key - Enforce key restrictions.Entra IDAuthentication methodsAuthenticationLowLowLowT1098.005nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.AF05Authentication Method - FIDO2 security key - Restricted.Entra IDAuthentication methodsAuthenticationLowLowLowT1098.005nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.AG01Authentication Method - General Settings - Manage migration.Entra IDAuthentication methodsAuthenticationLowLowMedium—nist-800-53-r5:CM-7Entra ID SCA (EIDSCA)EIDSCA.CR02Consent Framework - Admin Consent Request - Reviewers will receive email notifications for requests.Entra IDApp consent and permissionsApplications and workload identitiesLowLowLow——Entra ID SCA (EIDSCA)EIDSCA.CR03Consent Framework - Admin Consent Request - Reviewers will receive email notifications when admin consent requests are about to expire.Entra IDApp consent and permissionsApplications and workload identitiesLowLowLow——Entra ID SCA (EIDSCA)EIDSCA.CR04Consent Framework - Admin Consent Request - Consent request duration (days).Entra IDApp consent and permissionsApplications and workload identitiesLowLowLow——Entra ID SCA (EIDSCA)EIDSCA.CR05Consent Framework - Admin Consent Request - Admin consent reviewers have valid query scopes.New in 3.0Entra IDApp consent and permissionsApplications and workload identitiesLowLowLow——Entra ID SCA (EIDSCA)EIDSCA.ST09Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to have access to groups content.Entra IDGroupsExternal access and sharingLowLowLow—nist-800-53-r5:AC-6, nist-800-53-r5:AC-21Entra ID SCA (EIDSCA)EIDSCA.AP14Default Authorization Settings - Default User Role Permissions - Allowed to read other users.Entra IDUser and directory settingsAccess controlInfo———nist-800-53-r5:AC-3Entra ID SCA (EIDSCA)
Entra IDAuthentication methodsAuthenticationHighLowLowT1566.002nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2)Entra ID SCA (EIDSCA)EIDSCA.AF02Authentication Method - FIDO2 security key - Allow self-service set up.Entra IDAuthentication methodsAuthenticationHighLowLowT1566.002—Entra ID SCA (EIDSCA)EIDSCA.AF03Authentication Method - FIDO2 security key - Enforce attestation.Entra IDAuthentication methodsAuthenticationHighLowLowT1098.005nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.AM01Authentication Method - Microsoft Authenticator - State.Entra IDAuthentication methodsAuthenticationHighLowLowT1110nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2)Entra ID SCA (EIDSCA)EIDSCA.AM03Authentication Method - Microsoft Authenticator - Require number matching for push notifications.Entra IDAuthentication methodsAuthenticationHighLowLowT1621nist-800-53-r5:IA-2(8), nist-800-53-r5:IA-2(1)Entra ID SCA (EIDSCA)EIDSCA.AM04Authentication Method - Microsoft Authenticator - Included users/groups of number matching for push notifications.Entra IDAuthentication methodsAuthenticationHighLowLowT1621nist-800-53-r5:IA-2(8), nist-800-53-r5:IA-2(1)Entra ID SCA (EIDSCA)EIDSCA.AP01Default Authorization Settings - Enabled Self service password reset for administrators.Entra IDUser and directory settingsPrivileged accessHighLowLowT1098nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.AP08Default Authorization Settings - User consent assignments match the restricted or Microsoft recommended baseline.Entra IDApp consent and permissionsApplications and workload identitiesHighMediumLowT1528, T1566.002nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5Entra ID SCA (EIDSCA)EIDSCA.AP09Default Authorization Settings - Allow user consent on risk-based apps.Entra IDApp consent and permissionsApplications and workload identitiesHighLowLowT1528, T1566.002nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5Entra ID SCA (EIDSCA)EIDSCA.AS04Authentication Method - SMS - Use for sign-in.Entra IDAuthentication methodsAuthenticationHighLowLowT1111, T1566.002nist-800-53-r5:CM-7, nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.AV01Authentication Method - Voice call - State.Entra IDAuthentication methodsAuthenticationHighMediumMediumT1621nist-800-53-r5:CM-7, nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.CP01Default Settings - Consent Policy Settings - Group owner consent for apps accessing data.Entra IDApp consent and permissionsApplications and workload identitiesHighLowLowT1528, T1566.002nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5Entra ID SCA (EIDSCA)EIDSCA.CP03Default Settings - Consent Policy Settings - Block user consent for risky apps.Entra IDApp consent and permissionsApplications and workload identitiesHighLowLowT1528, T1566.002nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5Entra ID SCA (EIDSCA)EIDSCA.CP04Default Settings - Consent Policy Settings - Users can request admin consent to apps they are unable to consent to.Entra IDApp consent and permissionsApplications and workload identitiesHighLowLowT1528, T1566.002nist-800-53-r5:CM-4Entra ID SCA (EIDSCA)EIDSCA.CR01Consent Framework - Admin Consent Request - Policy to enable or disable admin consent request feature.Entra IDApp consent and permissionsApplications and workload identitiesHighLowLowT1528, T1566.002nist-800-53-r5:CM-4Entra ID SCA (EIDSCA)EIDSCA.PR01Default Settings - Password Rule Settings - Password Protection - Mode.Entra IDPassword protectionAuthenticationHighLowLowT1110nist-800-53-r5:IA-5(1)Entra ID SCA (EIDSCA)EIDSCA.PR02Default Settings - Password Rule Settings - Password Protection - Enable password protection on Windows Server Active Directory.Entra IDPassword protectionAuthenticationHighLowLowT1110nist-800-53-r5:IA-5(1)Entra ID SCA (EIDSCA)EIDSCA.AF06Authentication Method - FIDO2 security key - Restrict specific keys.Entra IDAuthentication methodsAuthenticationMediumLowLowT1098.005nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.AG02Authentication Method - General Settings - Report suspicious activity - State.Entra IDAuthentication methodsAuthenticationMediumLowLowT1621, T1078.004nist-800-53-r5:SI-4(5)Entra ID SCA (EIDSCA)EIDSCA.AG03Authentication Method - General Settings - Report suspicious activity - Included users/groups.Entra IDAuthentication methodsAuthenticationMediumLowLowT1621, T1078.004—Entra ID SCA (EIDSCA)EIDSCA.AM02Authentication Method - Microsoft Authenticator - Allow use of Microsoft Authenticator OTP.Entra IDAuthentication methodsAuthenticationMediumMediumLowT1566.002—Entra ID SCA (EIDSCA)EIDSCA.AM06Authentication Method - Microsoft Authenticator - Show application name in push and passwordless notifications.Entra IDAuthentication methodsAuthenticationMediumLowLowT1621nist-800-53-r5:IA-2(13), nist-800-53-r5:IA-2(1)Entra ID SCA (EIDSCA)EIDSCA.AM07Authentication Method - Microsoft Authenticator - Included users/groups to show application name in push and passwordless notifications.Entra IDAuthentication methodsAuthenticationMediumLowLowT1621nist-800-53-r5:IA-2(13), nist-800-53-r5:IA-2(1)Entra ID SCA (EIDSCA)EIDSCA.AM09Authentication Method - Microsoft Authenticator - Show geographic location in push and passwordless notifications.Entra IDAuthentication methodsAuthenticationMediumLowLowT1621nist-800-53-r5:IA-2(13), nist-800-53-r5:IA-2(1)Entra ID SCA (EIDSCA)EIDSCA.AM10Authentication Method - Microsoft Authenticator - Included users/groups to show geographic location in push and passwordless notifications.Entra IDAuthentication methodsAuthenticationMediumLowLowT1621nist-800-53-r5:IA-2(13), nist-800-53-r5:IA-2(1)Entra ID SCA (EIDSCA)EIDSCA.AP04Default Authorization Settings - Guest invite restrictions.Entra IDExternal identitiesExternal access and sharingMediumMediumLowT1136.003nist-800-53-r5:AC-6(10)Entra ID SCA (EIDSCA)EIDSCA.AP05Default Authorization Settings - Sign-up for email based subscription.Entra IDUser and directory settingsAccess controlMediumLowLow——Entra ID SCA (EIDSCA)EIDSCA.AP06Default Authorization Settings - User can join the tenant by email validation.Entra IDUser and directory settingsAccess controlMediumLowLowT1136.003nist-800-53-r5:AC-2Entra ID SCA (EIDSCA)EIDSCA.AP07Default Authorization Settings - Guest user access.Entra IDExternal identitiesExternal access and sharingMediumLowLowT1087.004, T1069.003nist-800-53-r5:AC-6Entra ID SCA (EIDSCA)EIDSCA.AP10Default Authorization Settings - Default User Role Permissions - Allowed to create Apps.Entra IDUser and directory settingsApplications and workload identitiesMediumLowLowT1098.001, T1528nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5Entra ID SCA (EIDSCA)EIDSCA.AP12Default Authorization Settings - Default User Role Permissions - Allowed to create Tenants.New in 3.0Entra IDUser and directory settingsAccess controlMediumLowLow—nist-800-53-r5:AC-6, nist-800-53-r5:CM-7Entra ID SCA (EIDSCA)EIDSCA.AP15Default Authorization Settings - Default User Role Permissions - Allowed to create agent identity blueprints.New in 3.0Entra IDAgent identitiesAI and agentsMediumLowLowT1136.003nist-800-53-r5:AC-6Entra ID SCA (EIDSCA)EIDSCA.AT01Authentication Method - Temporary Access Pass - State.Entra IDAuthentication methodsAuthenticationMediumLowLow——Entra ID SCA (EIDSCA)EIDSCA.AT02Authentication Method - Temporary Access Pass - One-time.Entra IDAuthentication methodsAuthenticationMediumLowLowT1078.004nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.PR03Default Settings - Password Rule Settings - Enforce custom list.Entra IDPassword protectionAuthenticationMediumLowLowT1110nist-800-53-r5:IA-5(1)Entra ID SCA (EIDSCA)EIDSCA.PR05Default Settings - Password Rule Settings - Smart Lockout - Lockout duration in seconds.Entra IDPassword protectionAuthenticationMediumLowLowT1110nist-800-53-r5:AC-7Entra ID SCA (EIDSCA)EIDSCA.PR06Default Settings - Password Rule Settings - Smart Lockout - Lockout threshold.Entra IDPassword protectionAuthenticationMediumLowLowT1110nist-800-53-r5:AC-7Entra ID SCA (EIDSCA)EIDSCA.ST08Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to become Group Owner.Entra IDGroupsExternal access and sharingMediumLowLowT1098nist-800-53-r5:AC-6Entra ID SCA (EIDSCA)EIDSCA.AF04Authentication Method - FIDO2 security key - Enforce key restrictions.Entra IDAuthentication methodsAuthenticationLowLowLowT1098.005nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.AF05Authentication Method - FIDO2 security key - Restricted.Entra IDAuthentication methodsAuthenticationLowLowLowT1098.005nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.AG01Authentication Method - General Settings - Manage migration.Entra IDAuthentication methodsAuthenticationLowLowMedium—nist-800-53-r5:CM-7Entra ID SCA (EIDSCA)EIDSCA.CR02Consent Framework - Admin Consent Request - Reviewers will receive email notifications for requests.Entra IDApp consent and permissionsApplications and workload identitiesLowLowLow——Entra ID SCA (EIDSCA)EIDSCA.CR03Consent Framework - Admin Consent Request - Reviewers will receive email notifications when admin consent requests are about to expire.Entra IDApp consent and permissionsApplications and workload identitiesLowLowLow——Entra ID SCA (EIDSCA)EIDSCA.CR04Consent Framework - Admin Consent Request - Consent request duration (days).Entra IDApp consent and permissionsApplications and workload identitiesLowLowLow——Entra ID SCA (EIDSCA)EIDSCA.CR05Consent Framework - Admin Consent Request - Admin consent reviewers have valid query scopes.New in 3.0Entra IDApp consent and permissionsApplications and workload identitiesLowLowLow——Entra ID SCA (EIDSCA)EIDSCA.ST09Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to have access to groups content.Entra IDGroupsExternal access and sharingLowLowLow—nist-800-53-r5:AC-6, nist-800-53-r5:AC-21Entra ID SCA (EIDSCA)EIDSCA.AP14Default Authorization Settings - Default User Role Permissions - Allowed to read other users.Entra IDUser and directory settingsAccess controlInfo———nist-800-53-r5:AC-3Entra ID SCA (EIDSCA)No checks match.