All groups in Conditional Access policies belong to a restricted management administrative unit

Maester checks this too

MT.1035 (All security groups assigned to Conditional Access Policies should be protected by RMAU.) checks the same setting. Running both reports it twice.

Overview

Microsoft has not published a description of this check yet.

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Medium
Effort to fix	Low
Impact on users	Low
Pillar	Identity
Category	Access control
Product	Entra ID
Feature	Conditional Access
Area	Privileged access
ATT&CK	T1098 Account Manipulation, T1556.009 Conditional Access Policies
Licence	P1
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.