{ "id": "CB-M365-AUTH-034", "standard": "m365", "version": "main", "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-034", "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-034.json", "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-034.yml", "profiles_effective": [ "hardened" ], "license": "Text CC BY 4.0, code Apache-2.0", "attribution": "CIRSEC Baselines, https://baselines.cirsec.org", "control": { "id": "CB-M365-AUTH-034", "title": "Keep Conditional Access policies free of broken references and unprotected exclusions", "finding": { "title": "Conditional Access policies contain silent configuration errors", "description": "Policies that point to deleted objects, have no target resource, leave exclusions uncovered or rely on groups any admin can edit do not protect what their name suggests." }, "status": "active", "profiles": [ "hardened" ], "risk": { "severity": "medium" }, "assessment": "manual", "tags": [ "conditional-access", "hygiene", "exclusions", "restricted-management", "governance" ], "applicability": { "requires": [ "Microsoft Entra ID P1" ] }, "description": "The set of Conditional Access policies is reviewed at least quarterly, and after each change,\nagainst these rules:\n\n1. No policy includes or excludes a deleted user, group or role (shown as an unknown object ID).\n2. Every enabled policy has at least one target resource, user action or authentication context.\n3. Every object excluded from a policy is covered by another policy that gives an equivalent\n protection (for example a dedicated policy for service accounts), except the emergency access\n accounts.\n4. Groups used to include or exclude users in policies are role-assignable groups or are placed\n in a restricted management administrative unit, so that only privileged administrators can\n change their membership.\n5. Microsoft-managed policies are not left in **Report-only**: each one is set to **On**, or to\n **Off** with a documented equivalent.\n6. Authentication method policies do not reference deleted groups.\n", "rationale": "Conditional Access fails open: a policy targeting a deleted group applies to nobody, a policy\nwithout resources does nothing, and an exclusion without a fallback is a permanent hole. Attackers\nwho obtain a Groups Administrator or User Administrator role add themselves to an exclusion group\nto escape MFA. None of these errors raise an alert; only a review finds them.\n", "impact": "Moving exclusion groups into a restricted management administrative unit means that User and\nGroups Administrators can no longer change them; the Conditional Access team or a Privileged Role\nAdministrator must do it. The review takes a few hours per quarter.\n", "notes": "The Maester tests MT.1035, MT.1036, MT.1038, MT.1066, MT.1067, MT.1184 and MT.1224 automate most\nof these checks. The Conditional Access gap analyzer workbook helps with rule 3.\n", "audit": { "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n Security Reader (Global Reader to also read administrative units).\n2. Browse to **Entra ID** > **Conditional Access** > **Policies** and open each policy:\n - **Users** and **Target resources** show no unresolved object ID (a GUID instead of a name);\n - **Target resources** is not empty;\n - every excluded user or group is either an emergency access account or is included in\n another enabled policy with an equivalent grant.\n3. Filter the policy list on the name prefix `Microsoft-managed:` and check that none is in\n **Report-only**.\n4. For each group used in a policy, open it under **Entra ID** > **Groups** and check that\n **Microsoft Entra roles can be assigned to the group** is **Yes**, or that it is a member of an\n administrative unit with **Restricted management** set to **Yes** (**Entra ID** > **Roles &\n admins** > **Admin units**).\n5. Browse to **Entra ID** > **Authentication methods** > **Policies** and check that the target\n groups of each method still exist.\n6. Alternative in PowerShell (Microsoft Graph, scope `Policy.Read.All`, `Group.Read.All`):\n list the policies with `Get-MgIdentityConditionalAccessPolicy`, collect the IDs in\n `Conditions.Users.IncludeGroups` and `ExcludeGroups`, and resolve each with `Get-MgGroup\n -GroupId `; an error means a deleted group. Or run Maester (read-only) with the tests\n listed in the notes.\n7. Fail on any broken reference, any enabled policy without target, any uncovered exclusion,\n any exclusion group editable by non-privileged administrators, or any Microsoft-managed\n policy left in **Report-only**.\n" }, "remediation": { "manual": "1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.\n2. Remove deleted objects from the policies, or delete policies that no longer have a purpose.\n3. Add the missing target resources, or delete untargeted policies.\n4. For each uncovered exclusion, create a dedicated policy for the excluded population (for\n example service accounts restricted to trusted locations), or remove the exclusion.\n5. Create an administrative unit with **Restricted management administrative unit** set to\n **Yes** (Privileged Role Administrator), and move the include and exclude groups into it.\n New groups can also be created as role-assignable.\n6. Review each Microsoft-managed policy in report-only mode, exclude the emergency access\n accounts, then set it to **On** or **Off**.\n7. Record the review date and repeat it every quarter.\n", "rollback": "Remove a group from the restricted management administrative unit to give back the\ndelegated administrators' rights on it.\n" }, "references": [ { "title": "Microsoft-managed Conditional Access policies", "url": "https://learn.microsoft.com/entra/identity/conditional-access/managed-policies", "publisher": "Microsoft", "kind": "vendor-doc", "accessed": "2026-10-24" }, { "title": "Restricted management administrative units in Microsoft Entra ID", "url": "https://learn.microsoft.com/entra/identity/role-based-access-control/admin-units-restricted-management", "publisher": "Microsoft", "kind": "vendor-doc", "accessed": "2026-10-24" }, { "title": "Conditional Access - users, groups, agents and workload identities", "url": "https://learn.microsoft.com/entra/identity/conditional-access/concept-conditional-access-users-groups", "publisher": "Microsoft", "kind": "vendor-doc", "accessed": "2026-10-24" }, { "title": "Maester Conditional Access tests", "url": "https://maester.dev/docs/tests/MT.1036", "publisher": "Maester", "kind": "tool", "accessed": "2026-10-24" } ], "mappings": [ { "framework": "nist-800-53r5", "framework_version": "5.1.1", "id": "CM-6", "relation": "related" }, { "framework": "nist-800-53r5", "framework_version": "5.1.1", "id": "AC-2", "relation": "related" } ], "threats": [ { "framework": "mitre-attack", "id": "T1098" }, { "framework": "mitre-attack", "id": "T1556.009" } ], "related_controls": [ { "id": "CB-M365-AUTH-045", "type": "related" }, { "id": "CB-M365-ADMIN-002", "type": "related" }, { "id": "CB-M365-AUTH-001", "type": "related" }, { "id": "CB-M365-AUTH-003", "type": "related" }, { "id": "CB-M365-AUTH-022", "type": "related" }, { "id": "CB-M365-ADMIN-014", "type": "related" } ], "authors": [ { "name": "Alice", "github": "Sn0wAlice" } ], "introduced_in": "0.1.0", "created": "2026-10-24", "updated": "2026-10-24" } }