# Conditional Access policy is present that blocks high agent risk sign-ins

Checks whether your tenant has at least one enabled Conditional Access policy that blocks agent identities detected as high risk.

Source: https://maester.dev/docs/tests/MT.1181

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/exeqz" title="ExeqZ · Original author"><img src="https://github.com/ExeqZ.png" alt="ExeqZ" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/exeqz">ExeqZ</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Entra ID · Conditional Access · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1181
```

## Overview

Checks whether your tenant has at least one enabled Conditional Access policy that blocks agent identities detected as high risk.

This check looks for enabled Microsoft Entra (Azure AD) Conditional Access policies that target agent identity with risk levels set to `High` and enforce a `Block` grant control.
Agents (service or managed identities used by automation or AI) that are flagged as high risk by Entra ID Protection should be prevented from authenticating to prevent potentially compromised AI agents from accessing organizational resources.

#### Remediation action:

To remediate, create or update a Conditional Access policy that:

- Users or agents: all agent identities.
- Target resources: All resources (formerly 'All cloud apps')
- Conditions: `Agent risk` to include `high`.
- Uses a grant control that includes the `Block` action.

Refer to Microsoft documentation when creating policies to ensure correct targeting and scope.

#### Related links

- Microsoft doc: https://learn.microsoft.com/entra/identity/conditional-access/policy-agent-block-high-risk

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1181 |
| Severity | High |
| Suite | Maester |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | AI and agents |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports controls | nist-800-53-r5:AC-2(12), nist-800-53-r5:AC-2(13) |
| PowerShell test | [Test-MtCaAgentRiskBlockPolicy](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1181.ps1) |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM_P2&AGENT_365 |

</details>

## Source

- Test: [`tests/maester/entra/Test.MT.1181.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1181.ps1)
- Documentation: [`tests/maester/entra/Test.MT.1181.md`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1181.md)