GR1 | Validation 2| All Cloud User Accounts MFA Conditional Access Policy (M)

[MathesonSho]

ItemName ENG: “All Cloud User Accounts MFA Conditional Access Policy (M)” ItemName FR: "Tous les comptes d’utilisateurs infonuagiques stratégie d’accès conditionnel AMF (M)"

Description: This is an existing control “Multi-Factor authentication required for all users by Conditional Access Policy” from GR3 in v1.0 Renamed to “All Cloud User Accounts MFA Conditional Access Policy (M)”. The intention is to ensure All User Accounts are adhering to a Conditional Access Policy enforcing MFA to login.

Opportunities to Improve the Existing MFA Conditional Access Policy

• Can there be more flexibility in what currently exists? For example 3.includedApplications this can be updated to 'All' OR contains 'Microsoft Admin Portals'
• Do we need a deny CAP for users without MFA to make this a complete check?

# check for a conditional access policy which meets these requirements:
# 1. state =  'enabled'
# 2. includedUsers = 'All'
# 3. includedApplications = 'All'
# 4. grantControls.builtInControls contains 'mfa'
# 5. clientAppTypes contains 'all'
# 6. userRiskLevels = @()
# 7. signInRiskLevels = @()
# 8. platforms = null
# 9. locations = null
# 10. devices = null
# 11. clientApplications = null

Optional Improvement: How often is this CAP applied to end users? Every single time vs per session?