Conditional Access App Control session policies are enforced for sensitive cloud apps
Overview
Section titled “Overview”A stolen session token can let a threat actor access a sensitive cloud app from an unmanaged device without triggering a new sign-in. Conditional Access App Control routes the session through Microsoft Defender for Cloud Apps, where session policies can monitor activity, block downloads or copying, require step-up authentication, and apply sensitivity labels. This check confirms that at least one enabled Conditional Access policy routes targeted cloud apps through Defender for Cloud Apps session control.
Remediation
Section titled “Remediation”- Protect apps with Microsoft Defender for Cloud Apps Conditional Access App Control
- Deploy Conditional Access App Control for featured apps
- Create access and session policies
- Conditional Access policy resource type
Run it
Section titled “Run it”The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
Install-Module ZeroTrustAssessment -Scope CurrentUserConnect-MaesterInvoke-Maester -Pack ZTA -SkipBuiltInLeave out -SkipBuiltIn to run Maester’s own checks in the same run.
About this check
| Severity | High |
| Effort to fix | Medium |
| Impact on users | Medium |
| Pillar | SecOps |
| Category | Identity threat protection |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Access control |
| ATT&CK | T1550.004 Web Session Cookie, T1530 Data from Cloud Storage |
| Licence | ADALLOM_S_STANDALONE&AAD_PREMIUM |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.
A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.