Step-up authentication is required upon risky in-session action

Overview

Initial sign-in multifactor authentication is no longer sufficient against adversary-in-the-middle phishing kits and token theft, which let a threat actor replay an authenticated cloud app session hours or days later without ever facing another prompt. Closing that gap takes two products: Microsoft Defender for Cloud Apps routes sensitive sessions through Conditional Access App Control and applies a session policy that recognizes a risky in-session action, and Microsoft Entra Conditional Access enforces the resulting step-up challenge with a risk condition plus a phishing-resistant authentication strength such as passkey, FIDO2, or Windows Hello for Business. This check verifies the Entra enforcement leg: that at least one enabled Conditional Access policy combines an identity risk condition with a phishing-resistant authentication strength grant control — the built-in Phishing-resistant MFA strength, or a custom strength whose allowed combinations only use FIDO2, certificate-based authentication (multifactor), or Windows Hello for Business. The Defender for Cloud Apps session policy that triggers the challenge is configured in the Defender portal and is not exposed through Microsoft Graph, so confirm it manually.

Remediation

• Common Conditional Access policy: Sign-in risk-based multifactor authentication
• Configure and enable risk policies
• Conditional Access authentication strength
• Risk-based access policies
• Protect apps with Microsoft Defender for Cloud Apps Conditional Access App Control

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Medium
Pillar	SecOps
Category	Identity threat protection
Product	Entra ID
Feature	Conditional Access
Area	Authentication
ATT&CK	T1557 Adversary-in-the-Middle, T1550.004 Web Session Cookie, T1539 Steal Web Session Cookie
Licence	ADALLOM_S_STANDALONE&AAD_PREMIUM_P2
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.