EIDSCA sync
The EIDSCA tests in Maester are generated from the Entra ID Security Config Analyzer (EIDSCA). This page shows which values come from EIDSCA and which Maester adds, and compares Maester with the latest EIDSCA config.
How the EIDSCA tests are made
- Thomas Naunheim maintains the checks of the Entra ID Security Config Analyzer in the EIDSCA config of the Attack & Defense Playbook repository. It is the source of every check: what to read, the recommended value, the severity and the documentation.
- Maester keeps a copy in build/eidsca/EidscaConfig.json, so a build needs no network and reproduces the committed tests exactly.
- The EIDSCA config does not carry the classification every Maester test declares. Maester keeps it in build/eidsca/eidsca-test-metadata.json, chosen with the attribute rubric:
FeatureAreaResourceTypeUserImpactImplementationCostMitreControlRelatedProduct. - build/eidsca/Update-EidscaTests.ps1 generates
tests/eidsca/Test.EIDSCA.<ID>.ps1and.mdand the internal functions that read the tenant value, for every check that has a recommended value. - Every week, a workflow compares the EIDSCA config with Maester. While they differ, it keeps one issue and one pull request with the regenerated tests open, both assigned to the EIDSCA maintainer, and updates them. Merging the pull request closes the issue; the next difference starts a new pair.
Compare with EIDSCA
Downloads the EIDSCA config from GitHub in your browser and compares it with the copy and classification this site was built from.
Fields of a check
| EIDSCA field | Where it goes in Maester |
|---|---|
CheckId | Id of the test (Test.EIDSCA.<ID>.ps1) |
DisplayName | Title, with the ControlName of its area |
Severity | Severity (Informational becomes Info) |
RecommendedValue | The value the test passes on; a check without one is not generated |
CurrentValue | The property the internal function Test-MtEidsca<ID> reads |
DefaultValue | Documentation, and whether the value is compared as a number |
SkipCondition | The skip in the test; an Entra ID licence skip becomes License |
SkipReason | The reason a skipped result shows |
Description | Test description and Markdown |
Recommendation | Markdown |
HowToFix | Remediation section of the Markdown |
PortalDeepLink | Link to the admin center in the Markdown |
MitreTactic | MITRE ATT&CK section of the Markdown |
MitreTechnique | MITRE ATT&CK section of the Markdown (Maester's Mitre attribute is its own) |
MitreMitigation | MITRE ATT&CK section of the Markdown |
Fields of a control area
| EIDSCA field | Where it goes in Maester |
|---|---|
ControlName | Start of the title of each check |
Description | Markdown |
Discovery | Discovery code that skip conditions read |
GraphUri | Graph request of Test-MtEidsca<ID> |
GraphDocsUrl | Link to the Graph documentation in the Markdown |
The checks in Maester
Severity and recommended value come from the EIDSCA config; the other columns, except MitreTechnique, are Maester's classification.
| Check | Severity | Recommended value | Feature | Area | Impact / cost | Mitre (Maester) | MitreTechnique (EIDSCA) | Control |
|---|---|---|---|---|---|---|---|---|
| EIDSCA.AF01 Authentication Method - FIDO2 security key - State | High | enabled | authentication-methods | authentication | Low / Low | T1566.002 | (empty) | nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2) |
| EIDSCA.AF02 Authentication Method - FIDO2 security key - Allow self-service set up | High | true | authentication-methods | authentication | Low / Low | T1566.002 | (empty) | (empty) |
| EIDSCA.AF03 Authentication Method - FIDO2 security key - Enforce attestation | High | true | authentication-methods | authentication | Low / Low | T1098.005 | (empty) | nist-800-53-r5:IA-5 |
| EIDSCA.AF04 Authentication Method - FIDO2 security key - Enforce key restrictions | Low | true | authentication-methods | authentication | Low / Low | T1098.005 | (empty) | nist-800-53-r5:IA-5 |
| EIDSCA.AF05 Authentication Method - FIDO2 security key - Restricted | Low | true | authentication-methods | authentication | Low / Low | T1098.005 | (empty) | nist-800-53-r5:IA-5 |
| EIDSCA.AF06 Authentication Method - FIDO2 security key - Restrict specific keys | Medium | true | authentication-methods | authentication | Low / Low | T1098.005 | (empty) | nist-800-53-r5:IA-5 |
| EIDSCA.AG01 Authentication Method - General Settings - Manage migration | Low | @('migrationComplete', '') | authentication-methods | authentication | Low / Medium | None | (empty) | nist-800-53-r5:CM-7 |
| EIDSCA.AG02 Authentication Method - General Settings - Report suspicious activity - State | Medium | enabled | authentication-methods | authentication | Low / Low | T1621, T1078.004 | (empty) | nist-800-53-r5:SI-4(5) |
| EIDSCA.AG03 Authentication Method - General Settings - Report suspicious activity - Included users/groups | Medium | all_users | authentication-methods | authentication | Low / Low | T1621, T1078.004 | (empty) | (empty) |
| EIDSCA.AM01 Authentication Method - Microsoft Authenticator - State | High | enabled | authentication-methods | authentication | Low / Low | T1110 | (empty) | nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2) |
| EIDSCA.AM02 Authentication Method - Microsoft Authenticator - Allow use of Microsoft Authenticator OTP | Medium | false | authentication-methods | authentication | Medium / Low | T1566.002 | (empty) | (empty) |
| EIDSCA.AM03 Authentication Method - Microsoft Authenticator - Require number matching for push notifications | High | enabled | authentication-methods | authentication | Low / Low | T1621 | (empty) | nist-800-53-r5:IA-2(8), nist-800-53-r5:IA-2(1) |
| EIDSCA.AM04 Authentication Method - Microsoft Authenticator - Included users/groups of number matching for push notifications | High | all_users | authentication-methods | authentication | Low / Low | T1621 | (empty) | nist-800-53-r5:IA-2(8), nist-800-53-r5:IA-2(1) |
| EIDSCA.AM06 Authentication Method - Microsoft Authenticator - Show application name in push and passwordless notifications | Medium | enabled | authentication-methods | authentication | Low / Low | T1621 | (empty) | nist-800-53-r5:IA-2(13), nist-800-53-r5:IA-2(1) |
| EIDSCA.AM07 Authentication Method - Microsoft Authenticator - Included users/groups to show application name in push and passwordless notifications | Medium | all_users | authentication-methods | authentication | Low / Low | T1621 | (empty) | nist-800-53-r5:IA-2(13), nist-800-53-r5:IA-2(1) |
| EIDSCA.AM09 Authentication Method - Microsoft Authenticator - Show geographic location in push and passwordless notifications | Medium | enabled | authentication-methods | authentication | Low / Low | T1621 | (empty) | nist-800-53-r5:IA-2(13), nist-800-53-r5:IA-2(1) |
| EIDSCA.AM10 Authentication Method - Microsoft Authenticator - Included users/groups to show geographic location in push and passwordless notifications | Medium | all_users | authentication-methods | authentication | Low / Low | T1621 | (empty) | nist-800-53-r5:IA-2(13), nist-800-53-r5:IA-2(1) |
| EIDSCA.AP01 Default Authorization Settings - Enabled Self service password reset for administrators | High | false | user-settings | privileged-access | Low / Low | T1098 | (empty) | nist-800-53-r5:IA-5 |
| EIDSCA.AP04 Default Authorization Settings - Guest invite restrictions | Medium | @('adminsAndGuestInviters','none') | external-identities | external-access | Medium / Low | T1136.003 | (empty) | nist-800-53-r5:AC-6(10) |
| EIDSCA.AP05 Default Authorization Settings - Sign-up for email based subscription | Medium | false | user-settings | access-control | Low / Low | None | (empty) | (empty) |
| EIDSCA.AP06 Default Authorization Settings - User can join the tenant by email validation | Medium | false | user-settings | access-control | Low / Low | T1136.003 | (empty) | nist-800-53-r5:AC-2 |
| EIDSCA.AP07 Default Authorization Settings - Guest user access | Medium | 2af84b1e-32c8-42b7-82bc-daa82404023b | external-identities | external-access | Low / Low | T1087.004, T1069.003 | (empty) | nist-800-53-r5:AC-6 |
| EIDSCA.AP08 Default Authorization Settings - User consent assignments match the restricted or Microsoft recommended baseline | High | 0 | app-consent | applications | Medium / Low | T1528, T1566.002 | T1566.002, T1078, T1550, T1528 | nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5 |
| EIDSCA.AP09 Default Authorization Settings - Allow user consent on risk-based apps | High | false | app-consent | applications | Low / Low | T1528, T1566.002 | T1566.002, T1078, T1550, T1528 | nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5 |
| EIDSCA.AP10 Default Authorization Settings - Default User Role Permissions - Allowed to create Apps | Medium | false | user-settings | applications | Low / Low | T1098.001, T1528 | T1566.002, T1078, T1550, T1528 | nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5 |
| EIDSCA.AP12 Default Authorization Settings - Default User Role Permissions - Allowed to create Tenants | Medium | false | user-settings | access-control | Low / Low | None | (empty) | nist-800-53-r5:AC-6, nist-800-53-r5:CM-7 |
| EIDSCA.AP14 Default Authorization Settings - Default User Role Permissions - Allowed to read other users | Info | true | user-settings | access-control | Low / Low | None | (empty) | nist-800-53-r5:AC-3 |
| EIDSCA.AP15 Default Authorization Settings - Default User Role Permissions - Allowed to create agent identity blueprints | Medium | false | agent-identities | ai | Low / Low | T1136.003 | (empty) | nist-800-53-r5:AC-6 |
| EIDSCA.AS04 Authentication Method - SMS - Use for sign-in | High | false | authentication-methods | authentication | Low / Low | T1111, T1566.002 | (empty) | nist-800-53-r5:CM-7, nist-800-53-r5:IA-5 |
| EIDSCA.AT01 Authentication Method - Temporary Access Pass - State | Medium | enabled | authentication-methods | authentication | Low / Low | None | (empty) | (empty) |
| EIDSCA.AT02 Authentication Method - Temporary Access Pass - One-time | Medium | true | authentication-methods | authentication | Low / Low | T1078.004 | (empty) | nist-800-53-r5:IA-5 |
| EIDSCA.AV01 Authentication Method - Voice call - State | High | disabled | authentication-methods | authentication | Medium / Medium | T1621 | (empty) | nist-800-53-r5:CM-7, nist-800-53-r5:IA-5 |
| EIDSCA.CP01 Default Settings - Consent Policy Settings - Group owner consent for apps accessing data | High | False | app-consent | applications | Low / Low | T1528, T1566.002 | T1566.002, T1078 | nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5 |
| EIDSCA.CP03 Default Settings - Consent Policy Settings - Block user consent for risky apps | High | true | app-consent | applications | Low / Low | T1528, T1566.002 | T1566.002, T1078 | nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5 |
| EIDSCA.CP04 Default Settings - Consent Policy Settings - Users can request admin consent to apps they are unable to consent to | High | true | app-consent | applications | Low / Low | T1528, T1566.002 | T1566.002, T1078 | nist-800-53-r5:CM-4 |
| EIDSCA.CR01 Consent Framework - Admin Consent Request - Policy to enable or disable admin consent request feature | High | true | app-consent | applications | Low / Low | T1528, T1566.002 | T1078, T1528, T1550, T1550.001, T1566.002 | nist-800-53-r5:CM-4 |
| EIDSCA.CR02 Consent Framework - Admin Consent Request - Reviewers will receive email notifications for requests | Low | true | app-consent | applications | Low / Low | None | T1078, T1528, T1550, T1550.001, T1566.002 | (empty) |
| EIDSCA.CR03 Consent Framework - Admin Consent Request - Reviewers will receive email notifications when admin consent requests are about to expire | Low | true | app-consent | applications | Low / Low | None | T1078, T1528, T1550, T1550.001, T1566.002 | (empty) |
| EIDSCA.CR04 Consent Framework - Admin Consent Request - Consent request duration (days) | Low | <=30 | app-consent | applications | Low / Low | None | T1078, T1528, T1550, T1550.001, T1566.002 | (empty) |
| EIDSCA.CR05 Consent Framework - Admin Consent Request - Admin consent reviewers have valid query scopes | Low | true | app-consent | applications | Low / Low | None | T1078, T1528, T1550, T1550.001, T1566.002 | (empty) |
| EIDSCA.PR01 Default Settings - Password Rule Settings - Password Protection - Mode | High | Enforce | password-protection | authentication | Low / Low | T1110 | T1110 | nist-800-53-r5:IA-5(1) |
| EIDSCA.PR02 Default Settings - Password Rule Settings - Password Protection - Enable password protection on Windows Server Active Directory | High | True | password-protection | authentication | Low / Low | T1110 | T1110 | nist-800-53-r5:IA-5(1) |
| EIDSCA.PR03 Default Settings - Password Rule Settings - Enforce custom list | Medium | True | password-protection | authentication | Low / Low | T1110 | T1110 | nist-800-53-r5:IA-5(1) |
| EIDSCA.PR05 Default Settings - Password Rule Settings - Smart Lockout - Lockout duration in seconds | Medium | >=60 | password-protection | authentication | Low / Low | T1110 | T1110 | nist-800-53-r5:AC-7 |
| EIDSCA.PR06 Default Settings - Password Rule Settings - Smart Lockout - Lockout threshold | Medium | <=10 | password-protection | authentication | Low / Low | T1110 | T1110 | nist-800-53-r5:AC-7 |
| EIDSCA.ST08 Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to become Group Owner | Medium | false | groups | external-access | Low / Low | T1098 | (empty) | nist-800-53-r5:AC-6 |
| EIDSCA.ST09 Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to have access to groups content | Low | True | groups | external-access | Low / Low | None | (empty) | nist-800-53-r5:AC-6, nist-800-53-r5:AC-21 |