Network-25396: Conditional Access policies enforce strong authentication for private apps #744
Conversation
There was a problem hiding this comment.
Pull request overview
This PR adds a new security assessment test (ID: 25396) that validates whether Conditional Access policies enforce strong authentication methods for Private Access applications within Microsoft Entra Global Secure Access.
Key changes:
- Implements comprehensive test logic to evaluate Private Access applications (both Per-app and Quick Access types) for CA policy coverage requiring MFA or authentication strength
- Introduces sophisticated authentication strength classification (Phishing-Resistant, Passwordless MFA, MFA baseline)
- Provides detailed reporting with manual review capability for apps protected via applicationFilter-based policies
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| src/powershell/tests/Test-Assessment.25396.ps1 | New test function that queries Private Access apps, evaluates CA policy coverage, classifies authentication strength levels, and generates detailed compliance reports with pass/fail/investigate status |
| src/powershell/tests/Test-Assessment.25396.md | Documentation explaining security risks of unprotected private apps and providing remediation guidance with links to Microsoft Learn articles |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
praneeth-0000
added
enhancement
alexandair
left a comment
alexandair
left a comment
There was a problem hiding this comment.
@praneeth-0000 Please, address my feedback.
Hi @alexandair , I've updated the logic for classifying phishing resistant auth level. You were right, according to updated docx, all combinations in allowedCombinations should have at least 1 phishing resistant method. |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Added test for 25396
Conditional Access policies enforce strong authentication for private apps