# At least one Conditional Access policy is configured to require MFA for all users

This test checks if the tenant has at least one Conditional Access policy requiring MFA for all users.

Source: https://maester.dev/docs/tests/MT.1007

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/f-bader" title="Fabian Bader · Original author"><img src="https://github.com/f-bader.png" alt="Fabian Bader" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/brianreidc7" title="Brian Reid · Co-contributor"><img src="https://github.com/brianreidc7.png" alt="Brian Reid" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/samerde" title="Sam Erde · Co-contributor"><img src="https://github.com/SamErde.png" alt="Sam Erde" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/f-bader">Fabian Bader</a> with 2 co-contributors</span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Entra ID · Conditional Access · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1007
```

## Overview

This test checks if the tenant has at least one Conditional Access policy requiring MFA for all users.

See [Require MFA for all users - Microsoft Learn](https://learn.microsoft.com/entra/identity/conditional-access/howto-conditional-access-policy-all-users-mfa)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1007 |
| Severity | High |
| Suite | Maester |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1110 Brute Force |
| Supports controls | nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2) |
| PowerShell test | [Test-MtCaMfaForAllUsers](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1007.ps1) |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |

</details>

## Source

- Test: [`tests/maester/entra/Test.MT.1007.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1007.ps1)
- Documentation: [`tests/maester/entra/Test.MT.1007.md`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1007.md)