# At least one Conditional Access policy is configured to require compliant or Entra hybrid joined devices for admins

Device compliance Conditional Access policy can be used to require devices to be compliant or hybrid Azure AD joined for admins.

Source: https://maester.dev/docs/tests/MT.1014

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/f-bader" title="Fabian Bader · Original author"><img src="https://github.com/f-bader.png" alt="Fabian Bader" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/retrodadson" title="Robin Dadswell · Co-contributor"><img src="https://github.com/RetroDadson.png" alt="Robin Dadswell" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/l-gosling" title="Lukas Gosling · Co-contributor"><img src="https://github.com/l-gosling.png" alt="Lukas Gosling" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/f-bader">Fabian Bader</a> with 2 co-contributors</span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Entra ID · Conditional Access · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1014
```

## Overview

Device compliance Conditional Access policy can be used to require devices to be compliant or hybrid Azure AD joined for admins.
This is a good way to prevent AITM attacks.

Learn more:
https://aka.ms/CATemplatesAdminDevices

#### Remediation action

Review the configuration described above.

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1014 |
| Severity | High |
| Suite | Maester |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Privileged access |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1539 Steal Web Session Cookie, T1557 Adversary-in-the-Middle |
| Supports controls | nist-800-53-r5:IA-3, nist-800-53-r5:AC-2(11) |
| PowerShell test | [Test-MtCaDeviceComplianceAdminsExists](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1014.ps1) |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |

</details>

## Source

- Test: [`tests/maester/entra/Test.MT.1014.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1014.ps1)
- Documentation: [`tests/maester/entra/Test.MT.1014.md`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1014.md)