Entra ID Security Config Analyzer Tests
These tests are based on the Entra ID Security Config Analyzer and verify Microsoft Entra mitigations for common identity attack scenarios. They are generated from the EIDSCA config; the EIDSCA sync page shows how and compares Maester with it.
Tests
| Test ID | Title | Severity | Product | Feature |
|---|---|---|---|---|
| EIDSCA.AF01 | Authentication Method - FIDO2 security key - State. | High | Entra ID | Authentication methods |
| EIDSCA.AF02 | Authentication Method - FIDO2 security key - Allow self-service set up. | High | Entra ID | Authentication methods |
| EIDSCA.AF03 | Authentication Method - FIDO2 security key - Enforce attestation. | High | Entra ID | Authentication methods |
| EIDSCA.AF04 | Authentication Method - FIDO2 security key - Enforce key restrictions. | Low | Entra ID | Authentication methods |
| EIDSCA.AF05 | Authentication Method - FIDO2 security key - Restricted. | Low | Entra ID | Authentication methods |
| EIDSCA.AF06 | Authentication Method - FIDO2 security key - Restrict specific keys. | Medium | Entra ID | Authentication methods |
| EIDSCA.AG01 | Authentication Method - General Settings - Manage migration. | Low | Entra ID | Authentication methods |
| EIDSCA.AG02 | Authentication Method - General Settings - Report suspicious activity - State. | Medium | Entra ID | Authentication methods |
| EIDSCA.AG03 | Authentication Method - General Settings - Report suspicious activity - Included users/groups. | Medium | Entra ID | Authentication methods |
| EIDSCA.AM01 | Authentication Method - Microsoft Authenticator - State. | High | Entra ID | Authentication methods |
| EIDSCA.AM02 | Authentication Method - Microsoft Authenticator - Allow use of Microsoft Authenticator OTP. | Medium | Entra ID | Authentication methods |
| EIDSCA.AM03 | Authentication Method - Microsoft Authenticator - Require number matching for push notifications. | High | Entra ID | Authentication methods |
| EIDSCA.AM04 | Authentication Method - Microsoft Authenticator - Included users/groups of number matching for push notifications. | High | Entra ID | Authentication methods |
| EIDSCA.AM06 | Authentication Method - Microsoft Authenticator - Show application name in push and passwordless notifications. | Medium | Entra ID | Authentication methods |
| EIDSCA.AM07 | Authentication Method - Microsoft Authenticator - Included users/groups to show application name in push and passwordless notifications. | Medium | Entra ID | Authentication methods |
| EIDSCA.AM09 | Authentication Method - Microsoft Authenticator - Show geographic location in push and passwordless notifications. | Medium | Entra ID | Authentication methods |
| EIDSCA.AM10 | Authentication Method - Microsoft Authenticator - Included users/groups to show geographic location in push and passwordless notifications. | Medium | Entra ID | Authentication methods |
| EIDSCA.AP01 | Default Authorization Settings - Enabled Self service password reset for administrators. | High | Entra ID | User and directory settings |
| EIDSCA.AP04 | Default Authorization Settings - Guest invite restrictions. | Medium | Entra ID | External identities |
| EIDSCA.AP05 | Default Authorization Settings - Sign-up for email based subscription. | Medium | Entra ID | User and directory settings |
| EIDSCA.AP06 | Default Authorization Settings - User can join the tenant by email validation. | Medium | Entra ID | User and directory settings |
| EIDSCA.AP07 | Default Authorization Settings - Guest user access. | Medium | Entra ID | External identities |
| EIDSCA.AP08 | Default Authorization Settings - User consent assignments match the restricted or Microsoft recommended baseline. | High | Entra ID | App consent and permissions |
| EIDSCA.AP09 | Default Authorization Settings - Allow user consent on risk-based apps. | High | Entra ID | App consent and permissions |
| EIDSCA.AP10 | Default Authorization Settings - Default User Role Permissions - Allowed to create Apps. | Medium | Entra ID | User and directory settings |
| EIDSCA.AP12 | Default Authorization Settings - Default User Role Permissions - Allowed to create Tenants. | Medium | Entra ID | User and directory settings |
| EIDSCA.AP14 | Default Authorization Settings - Default User Role Permissions - Allowed to read other users. | Info | Entra ID | User and directory settings |
| EIDSCA.AP15 | Default Authorization Settings - Default User Role Permissions - Allowed to create agent identity blueprints. | Medium | Entra ID | Agent identities |
| EIDSCA.AS04 | Authentication Method - SMS - Use for sign-in. | High | Entra ID | Authentication methods |
| EIDSCA.AT01 | Authentication Method - Temporary Access Pass - State. | Medium | Entra ID | Authentication methods |
| EIDSCA.AT02 | Authentication Method - Temporary Access Pass - One-time. | Medium | Entra ID | Authentication methods |
| EIDSCA.AV01 | Authentication Method - Voice call - State. | High | Entra ID | Authentication methods |
| EIDSCA.CP01 | Default Settings - Consent Policy Settings - Group owner consent for apps accessing data. | High | Entra ID | App consent and permissions |
| EIDSCA.CP03 | Default Settings - Consent Policy Settings - Block user consent for risky apps. | High | Entra ID | App consent and permissions |
| EIDSCA.CP04 | Default Settings - Consent Policy Settings - Users can request admin consent to apps they are unable to consent to. | High | Entra ID | App consent and permissions |
| EIDSCA.CR01 | Consent Framework - Admin Consent Request - Policy to enable or disable admin consent request feature. | High | Entra ID | App consent and permissions |
| EIDSCA.CR02 | Consent Framework - Admin Consent Request - Reviewers will receive email notifications for requests. | Low | Entra ID | App consent and permissions |
| EIDSCA.CR03 | Consent Framework - Admin Consent Request - Reviewers will receive email notifications when admin consent requests are about to expire. | Low | Entra ID | App consent and permissions |
| EIDSCA.CR04 | Consent Framework - Admin Consent Request - Consent request duration (days). | Low | Entra ID | App consent and permissions |
| EIDSCA.CR05 | Consent Framework - Admin Consent Request - Admin consent reviewers have valid query scopes. | Low | Entra ID | App consent and permissions |
| EIDSCA.PR01 | Default Settings - Password Rule Settings - Password Protection - Mode. | High | Entra ID | Password protection |
| EIDSCA.PR02 | Default Settings - Password Rule Settings - Password Protection - Enable password protection on Windows Server Active Directory. | High | Entra ID | Password protection |
| EIDSCA.PR03 | Default Settings - Password Rule Settings - Enforce custom list. | Medium | Entra ID | Password protection |
| EIDSCA.PR05 | Default Settings - Password Rule Settings - Smart Lockout - Lockout duration in seconds. | Medium | Entra ID | Password protection |
| EIDSCA.PR06 | Default Settings - Password Rule Settings - Smart Lockout - Lockout threshold. | Medium | Entra ID | Password protection |
| EIDSCA.ST08 | Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to become Group Owner. | Medium | Entra ID | Groups |
| EIDSCA.ST09 | Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to have access to groups content. | Low | Entra ID | Groups |