Add: MT.1181 Check if a Conditional Access policy is present that blocks high agent risk signins

powershell/Maester.psd1

@@ -100,7 +100,7 @@
         'Test-MtCaGroupsRestricted', 'Test-MtCaLicenseUtilization', 'Test-MtCaMfaForAdmin', 'Test-MtCaMfaForAdminManagement',
         'Test-MtCaMfaForAllUsers', 'Test-MtCaMfaForGuest', 'Test-MtCaMfaForRiskySignIn', 'Test-MtCaMisconfiguredIDProtection',
         'Test-MtCaReferencedGroupsExist', 'Test-MtCaReferencedObjectsExist', 'Test-MtCaRequirePasswordChangeForHighUserRisk',
-        'Test-MtCaSecureSecurityInfoRegistration', 'Test-MtCaWIFBlockLegacyAuthentication', 'Test-MtCertificateConnectors',
+        'Test-MtCaSecureSecurityInfoRegistration', 'Test-MtCaWIFBlockLegacyAuthentication', 'Test-MtCaAgentRiskBlockPolicy', 'Test-MtCertificateConnectors',
         'Test-MtCis365PublicGroup', 'Test-MtCisaActivationNotification', 'Test-MtCisaAntiSpamAllowList',
         'Test-MtCisaAntiSpamSafeList', 'Test-MtCisaAppAdminConsent', 'Test-MtCisaAppGroupOwnerConsent',
         'Test-MtCisaAppRegistration', 'Test-MtCisaAppUserConsent', 'Test-MtCisaAssignmentNotification',

powershell/public/maester/entra/Test-MtCaAgentRiskBlockPolicy.md

@@ -0,0 +1,19 @@
+Checks whether your tenant has at least one enabled Conditional Access policy that blocks agent identities detected as high risk.
+
+This check looks for enabled Microsoft Entra (Azure AD) Conditional Access policies that target agent identity with risk levels set to `High` and enforce a `Block` grant control.
+Agents (service or managed identities used by automation or AI) that are flagged as high risk by Entra ID Protection should be prevented from authenticating to prevent potentially compromised AI agents from accessing organizational resources.
+
+#### Remediation action:
+
+To remediate, create or update a Conditional Access policy that:
+
+- Users or agents: all agent identities.
+- Target resources: All resources (formerly 'All cloud apps')
+- Conditions: `Agent risk` to include `high`.
+- Uses a grant control that includes the `Block` action.
+
+Refer to Microsoft documentation when creating policies to ensure correct targeting and scope.
+
+#### Related links
+
+- Microsoft doc: https://learn.microsoft.com/entra/identity/conditional-access/policy-agent-block-high-risk

powershell/public/maester/entra/Test-MtCaAgentRiskBlockPolicy.ps1

@@ -0,0 +1,50 @@
+function Test-MtCaAgentRiskBlockPolicy {
+    <#
+    .Synopsis
+    Checks if the tenant has at least one conditional access policy that blocks agent identities based on their risk level.
+
+    .Description
+    Organizations should block agent identities that are detected as high risk by Microsoft Entra ID Protection to helping prevent potentially compromised AI agents from accessing your organization's resources.
+
+    Learn more:
+    https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-agent-block-high-risk
+
+    .Example
+    Test-MtCaAgentRiskBlockPolicy
+
+    .LINK
+    https://maester.dev/docs/commands/Test-MtCaAgentRiskBlockPolicy
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param ()
+
+    try {
+        $policies =  Get-MtConditionalAccessPolicy | Where-Object { $_.state -eq 'enabled'}
+
+        $policiesResult = New-Object System.Collections.ArrayList
+        $result = $false
+
+        foreach ($policy in $policies) {
+            if ($policy.conditions.agentIdRiskLevels -match 'high' -and $policy.grantControls.builtInControls -match 'block'){
+                $result = $true
+                $policiesResult.Add($policy) | Out-Null
+            } else {
+                $CurrentResult = $false
+            }
+            Write-Verbose "$($policy.displayName) - $CurrentResult"
+        }
+
+        if ( $result ) {
+            $testResult = "Well done! The following conditional access policies sufficiently blockes high risk agent identities:`n`n%TestResult%"
+        } else {
+            $testResult = 'No conditional access policy found that targets high risk agent identities.'
+        }
+
+        Add-MtTestResultDetail -Result $testResult -GraphObjects $policiesResult -GraphObjectType ConditionalAccess
+        return $result
+    } catch {
+        Add-MtTestResultDetail -SkippedBecause Error -SkippedError $_
+        return $null
+    }
+}

tests/maester-config.json

@@ -1474,6 +1474,11 @@
       "Severity": "High",
       "Title": "Sample Submission should send safe samples automatically"
     },
+    {
+      "Id": "MT.1181",
+      "Severity": "High",
+      "Title": "Conditional Access policy is present that blocks high agent risk signins"
+    },
     {
       "Id": "ORCA.100",
       "Severity": "Medium",
@@ -2030,4 +2035,4 @@
       "Title": "(Organization) Disallow extensions from accessing resources on the local network"
     }
   ]
-}
+}