Add test MT.1106 to verify Protected Actions Auth Contexts have CA policies #1356

Copilot · 2025-12-02T16:41:59Z

Description

Fixes the issue where Protected Actions with Authentication Contexts assigned may not actually be protected if the context isn't referenced by any Conditional Access policy. Without a CA policy enforcing the auth context, users aren't prompted for step-up authentication.

Fixes #997

Changes:

Test-MtCaAuthContextProtectedActionsExist.ps1 - New test function that:
- Fetches auth contexts from identity/conditionalAccess/authenticationContextClassReferences
- Checks PIM role management policies for unifiedRoleManagementPolicyAuthenticationContextRule rules (with isEnabled check)
- Compares against enabled CA policies' includeAuthenticationContextClassReferences
- Fails if any auth context used in Protected Actions lacks a CA policy reference
- Detects deleted auth contexts by iterating over protected action contexts and showing "(Deleted or not found)" for missing contexts
Test-MtCaAuthContextProtectedActionsExist.md - Function documentation
Test-ConditionalAccessBaseline.Tests.ps1 - Added MT.1106 test case
MT.1106.md - Website documentation

# Example usage
Test-MtCaAuthContextProtectedActionsExist
# Returns $true if all Protected Action auth contexts have CA policies
# Returns $false with details table if any are unprotected

Contribution Checklist

Before submitting this PR, please confirm you have completed the following:

📖 Read the guidelines for contributing to this repository.
🧪 Ensure the build and unit tests pass by running /powershell/tests/pester.ps1 on your local system.

Join us at the Maester repository discussions 💬 or Entra Discord 🧑‍💻 for more help and conversations!

Original prompt

This section details on the original issue you should resolve

<issue_title>🙏Maester Test to Ensure all Protected Actions Auth Context have a conditional access referenced.</issue_title>
<issue_description>Maester Test to Ensure all Protected Actions Auth Context have a conditional access referenced.

Maester Test to Ensure all Protected Actions Auth Context have a conditional access referenced. There is a potential for an auth context to get deleted while still being referenced in a CA

If no Conditional access Policy is referenced by the authentication context then the protected action is not well protecting anything

</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes 🙏Maester Test to Ensure all Protected Actions Auth Context have a conditional access referenced. #997

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

…ons Auth Context validation Co-authored-by: SamErde <[email protected]>

cloudflare-workers-and-pages · 2025-12-02T16:49:33Z

Deploying maester with Cloudflare Pages

Latest commit:	`550d061`
Status:	✅ Deploy successful!
Preview URL:	https://acf90e9f.maester.pages.dev
Branch Preview URL:	https://copilot-add-maester-test-con.maester.pages.dev

View logs

Co-authored-by: SamErde <[email protected]>

Copilot

Pull request overview

Adds a new validation test to ensure that protected actions using Authentication Contexts are actually enforced by Conditional Access policies, plus associated documentation and baseline test wiring.

Introduces Test-MtCaAuthContextProtectedActionsExist to detect Authentication Contexts used by Protected Actions but not referenced by any CA policy.
Wires the test into the Conditional Access baseline suite (MT.1090).
Adds user-facing documentation for the test and website page.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
website/docs/tests/maester/MT.1090.md	New website doc explaining MT.1090 test purpose, remediation steps, and links.
tests/Maester/Entra/Test-ConditionalAccessBaseline.Tests.ps1	Adds the MT.1090 test case to the Entra Conditional Access baseline suite.
powershell/public/maester/entra/Test-MtCaAuthContextProtectedActionsExist.ps1	Implements the test logic to correlate protected actions’ Authentication Contexts with CA policies.
powershell/public/maester/entra/Test-MtCaAuthContextProtectedActionsExist.md	Adds command documentation with remediation steps and related links.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-02T17:42:35Z

powershell/public/maester/entra/Test-MtCaAuthContextProtectedActionsExist.ps1

+        $caPolicies = Get-MtConditionalAccessPolicy
+
+        # Collect all auth context IDs referenced in CA policies
+        $authContextsInCAPolicies = [System.Collections.Generic.HashSet[string]]::new()
+        foreach ($policy in $caPolicies) {
+            if ($policy.conditions.applications.includeAuthenticationContextClassReferences) {
+                foreach ($context in $policy.conditions.applications.includeAuthenticationContextClassReferences) {
+                    [void]$authContextsInCAPolicies.Add($context)
+                }
+            }
+        }


CA policy state is not considered when determining protection. Disabled policies do not enforce Authentication Contexts, so counting them can yield false positives. Please filter to enabled policies before collecting includeAuthenticationContextClassReferences, e.g.: $caPolicies = Get-MtConditionalAccessPolicy | Where-Object { $_.state -eq 'enabled' }.

A 'Disabled' or 'ReportOnly' policy might still be in development. Should we still alert on these? I lean very slightly towards 'yes' because the ultimate goal is to have them in effect and not create a false sense of security with regards to the protected action configuration.

Changed to filter only enabled CA policies in commit 550d061: $caPolicies = Get-MtConditionalAccessPolicy | Where-Object { $_.state -eq 'enabled' }. Regarding @SamErde's point about disabled/report-only policies - the current implementation alerts if the auth context is only in disabled policies, since those don't provide actual protection.

That's right, the test should still fail if the policy is not enabled.

powershell/public/maester/entra/Test-MtCaAuthContextProtectedActionsExist.ps1

website/docs/tests/maester/MT.1090.md

powershell/public/maester/entra/Test-MtCaAuthContextProtectedActionsExist.md

Co-authored-by: Copilot <[email protected]>

SamErde

The test ID 'MT.1090' is already taken. 'MT.1106' should be used for this test. References within this PR need to be changed accordingly.

…s, check isEnabled for rules, detect deleted contexts Co-authored-by: SamErde <[email protected]>

Copilot · 2025-12-02T18:13:32Z

The test ID 'MT.1090' is already taken. 'MT.1106' should be used for this test. References within this PR need to be changed accordingly.

Renamed to MT.1106 in commit 550d061. Updated the website doc, test file reference, title, and slug accordingly.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Initial plan

2b5cc42

Copilot AI assigned Copilot and SamErde Dec 2, 2025

Copilot started work on behalf of SamErde December 2, 2025 16:42 View session

Add Test-MtCaAuthContextProtectedActionsExist test for Protected Acti…

8b6b788

…ons Auth Context validation Co-authored-by: SamErde <[email protected]>

Remove unused API calls for authentication strength policies

532c4f5

Co-authored-by: SamErde <[email protected]>

Copilot AI changed the title ~~[WIP] Add Maester test for protected actions auth context~~ Add test MT.1090 to verify Protected Actions Auth Contexts have CA policies Dec 2, 2025

Copilot AI requested a review from SamErde December 2, 2025 16:53

Copilot finished work on behalf of SamErde December 2, 2025 16:53

SamErde requested a review from Copilot December 2, 2025 17:37

Copilot started reviewing on behalf of SamErde December 2, 2025 17:38 View session

Copilot finished reviewing on behalf of SamErde December 2, 2025 17:41

SamErde added enhancement New feature or request help wanted Extra attention is needed maester-test Related to a Maester test work started entra Microsoft Entra labels Dec 2, 2025

Copilot AI reviewed Dec 2, 2025

View reviewed changes

SamErde reviewed Dec 2, 2025

View reviewed changes

powershell/public/maester/entra/Test-MtCaAuthContextProtectedActionsExist.md Outdated Show resolved Hide resolved

SamErde mentioned this pull request Dec 2, 2025

#️⃣ Pick next Maester test sequence number #697

Open

Update website/docs/tests/maester/MT.1090.md

4ca5797

Co-authored-by: Copilot <[email protected]>

SamErde requested changes Dec 2, 2025

View reviewed changes

Copilot started work on behalf of SamErde December 2, 2025 18:10 View session

Address review feedback: rename to MT.1106, filter enabled CA policie…

550d061

…s, check isEnabled for rules, detect deleted contexts Co-authored-by: SamErde <[email protected]>

Copilot AI changed the title ~~Add test MT.1090 to verify Protected Actions Auth Contexts have CA policies~~ Add test MT.1106 to verify Protected Actions Auth Contexts have CA policies Dec 2, 2025

Copilot AI requested a review from SamErde December 2, 2025 18:16

Copilot finished work on behalf of SamErde December 2, 2025 18:16

SamErde marked this pull request as ready for review December 2, 2025 18:34

SamErde requested review from a team as code owners December 2, 2025 18:34

SamErde removed help wanted Extra attention is needed work started labels Dec 4, 2025

SamErde requested a review from Copilot December 4, 2025 13:27

Copilot started reviewing on behalf of SamErde December 4, 2025 13:28 View session

Copilot finished reviewing on behalf of SamErde December 4, 2025 13:30

Copilot AI reviewed Dec 4, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add test MT.1106 to verify Protected Actions Auth Contexts have CA policies #1356

Add test MT.1106 to verify Protected Actions Auth Contexts have CA policies #1356

Copilot AI commented Dec 2, 2025 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages bot commented Dec 2, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Dec 2, 2025

Uh oh!

SamErde Dec 2, 2025

Uh oh!

Copilot AI Dec 2, 2025

Uh oh!

SamErde Dec 4, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

SamErde left a comment

Uh oh!

Copilot AI commented Dec 2, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Add test MT.1106 to verify Protected Actions Auth Contexts have CA policies #1356

Are you sure you want to change the base?

Add test MT.1106 to verify Protected Actions Auth Contexts have CA policies #1356

Conversation

Copilot AI commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Contribution Checklist

Comments on the Issue (you are @copilot in this section)

Uh oh!

cloudflare-workers-and-pages bot commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying maester with Cloudflare Pages

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

SamErde Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

SamErde Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

SamErde left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Dec 2, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Dec 2, 2025 •

edited

Loading

cloudflare-workers-and-pages bot commented Dec 2, 2025 •

edited

Loading