Conditional access policies should be active

High Azure General tenantsecurity-conditional-access-policies-active

Applies to

Microsoft.Graph/tenantSecurity

What CGPulse checks

A resource passes this rule when conditionalAccess.hasEnabledPolicies must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Create Conditional Access policies to enforce MFA and risk-based sign-in protection. In Azure Portal: Entra ID > Security > Conditional Access > create policies. See: https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview

CLI

az rest --method GET --url "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" --query "value[].{name:displayName,state:state}" -o table

Bicep

// Configure at: https://portal.azure.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies

Terraform

# Entra ID configuration - use AzureAD provider
# resource "azuread_conditional_access_policy" "example" {
#   display_name = "Require MFA for all users"
#   state        = "enabled"
#   conditions { ... }
#   grant_controls { built_in_controls = ["mfa"] }
# }

Compliance frameworks

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan