# At least one Conditional Access policy is configured to require MFA for guest access

This check verifies if there is at least one Conditional Access policy that requires multifactor authentication for all guest accounts.

Source: https://maester.dev/docs/tests/MT.1016

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/f-bader" title="Fabian Bader · Original author"><img src="https://github.com/f-bader.png" alt="Fabian Bader" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/merill" title="Merill Fernando · Co-contributor"><img src="https://github.com/merill.png" alt="Merill Fernando" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/samerde" title="Sam Erde · Co-contributor"><img src="https://github.com/SamErde.png" alt="Sam Erde" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/f-bader">Fabian Bader</a> with 2 co-contributors</span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Entra ID · Conditional Access · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1016
```

## Overview

This check verifies if there is at least one Conditional Access policy that requires multifactor authentication for all guest accounts.

See [Require multifactor authentication for guest access - Microsoft Learn](https://learn.microsoft.com/entra/identity/conditional-access/howto-policy-guest-mfa)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1016 |
| Severity | High |
| Suite | Maester |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1110 Brute Force |
| Supports controls | nist-800-53-r5:IA-2(1), nist-800-53-r5:AC-20 |
| PowerShell test | [Test-MtCaMfaForGuest](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1016.ps1) |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |

</details>

## Source

- Test: [`tests/maester/entra/Test.MT.1016.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1016.ps1)
- Documentation: [`tests/maester/entra/Test.MT.1016.md`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1016.md)