# At least one Conditional Access policy is configured with device compliance

Device compliance Conditional Access policy can be used to require devices to be compliant with the tenant's device compliance policy.

Source: https://maester.dev/docs/tests/MT.1001

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/merill" title="Merill Fernando · Original author"><img src="https://github.com/merill.png" alt="Merill Fernando" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/f-bader" title="Fabian Bader · Co-contributor"><img src="https://github.com/f-bader.png" alt="Fabian Bader" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/weycc81" title="Stefan Wey · Co-contributor"><img src="https://github.com/weyCC81.png" alt="Stefan Wey" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/merill">Merill Fernando</a> with 2 co-contributors</span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Entra ID · Conditional Access · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1001
```

## Overview

Device compliance Conditional Access policy can be used to require devices to be compliant with the tenant's device compliance policy.

Learn more:
https://learn.microsoft.com/entra/identity/conditional-access/howto-conditional-access-policy-compliant-device

#### Remediation action

Review the configuration described above.

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1001 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Access control |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports controls | nist-800-53-r5:AC-2(11), nist-800-53-r5:IA-3 |
| PowerShell test | [Test-MtCaDeviceComplianceExists](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1001.ps1) |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |

</details>

## Source

- Test: [`tests/maester/entra/Test.MT.1001.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1001.ps1)
- Documentation: [`tests/maester/entra/Test.MT.1001.md`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1001.md)