Test-MtCaSecureSecurityInfoRegistration
SYNOPSIS
Checks if the tenant has at least one Conditional Access policy securing security info registration.
SYNTAX
Test-MtCaSecureSecurityInfoRegistration [-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Security info registration Conditional Access policy can secure the registration of security info for users in the tenant.
A policy is considered a match when it is enabled and configured to secure security info registration from a trusted location only, i.e. it targets all users, includes the 'urn:user:registersecurityinfo' user action, applies to all client apps, includes all locations, and excludes 'AllTrusted' or a named location marked as trusted.
The excluded location has to be trusted for the policy to match. Excluding an untrusted named location leaves registration unprotected from everywhere that location covers, so it does not count. Only IP named locations can be marked trusted - country named locations have no trust concept, and an exclusion that no longer resolves to an existing location does not count either.
A policy scoped to the browser client app only does not match. Security info is not registered through the browser alone - the user action is also triggered from native apps such as Microsoft Authenticator when an authentication method is added - so the policy has to apply to all client apps to cover every registration path. This is why the user action is selected differently from a standard cloud app, and it is the configuration Microsoft recommends.
Learn more: https://learn.microsoft.com/entra/identity/conditional-access/howto-conditional-access-policy-registration
EXAMPLES
EXAMPLE 1
Test-MtCaSecureSecurityInfoRegistration
PARAMETERS
-ProgressAction
Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.
INPUTS
OUTPUTS
System.Boolean
NOTES
RELATED LINKS
https://maester.dev/docs/commands/Test-MtCaSecureSecurityInfoRegistration