EIDCA-009: Device Compliance Requirement in CA
- Plataforma
- Entra ID / M365
- Categoría
- Entra ID Conditional Access
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Conditional Access policies should require device compliance to ensure only managed and healthy devices can access organizational resources. Without device compliance requirements, unmanaged or compromised devices can access sensitive data, increasing the risk of data exfiltration and malware propagation.
Valor recomendado
Device compliance or Hybrid Azure AD join required for access to all cloud applications
Remediación
Create or update Conditional Access policies to require device compliance or Hybrid Azure AD join as a grant control for all cloud applications. Ensure Intune device compliance policies are configured with appropriate security baselines before enforcing this requirement. Use report-only mode initially to assess impact, then transition to enforcement after confirming managed device coverage is sufficient.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- CISA SCuBA
- MS.AAD.3.7v1
- NIST SP 800-53
- AC-17(2), CM-6
- CIS M365 Benchmark
- 5.2.2.2