SecOps - 41083 - Step-up authentication is required upon risky in-session action

[Manoj Kesana (Manoj-Kesana)]

No description provided.

[Copilot]

Pull request overview

Adds a new SecOps assessment (41083) to evaluate whether Microsoft Entra Conditional Access enforces step-up authentication for risky in-session actions by checking enabled CA policies for risk conditions and authentication strength controls, and provides accompanying markdown guidance.

Changes:

• Introduces Test-Assessment-41083 to query enabled Conditional Access policies via Microsoft Graph (beta), evaluate risk + auth-strength configuration, and emit a markdown results table with portal links.
• Adds Test-Assessment.41083.md with background and remediation references, integrating the %TestResult% placeholder.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/powershell/tests/Test-Assessment.41083.ps1	New assessment implementation: Graph query, evaluation logic, and markdown report generation.
src/powershell/tests/Test-Assessment.41083.md	New assessment documentation/remediation links and results placeholder.

[Aleksandar Nikolić (alexandair)]

Manoj Kesana (@Manoj-Kesana) Please, address my feedback.

There are also some spec issues:

The Specification Contains Conflicting Pass Rules

Locations:

• Strong phishing-resistant requirement: /ztspecs/specs/secops/41083.md#L74-L78
• Simplified non-null requirement: /ztspecs/specs/secops/41083.md#L86-L95

The pass criteria require a phishing-resistant built-in or custom strength, while the later evaluation steps require only a non-null authenticationStrength. The current implementation follows the weaker evaluation steps, but the title, customer explanation, security rationale, and remediation all support the stronger requirement.

Recommendation: Update the evaluation section to explicitly classify the strength ID and custom allowedCombinations.

4.3 The Specification Describes An Unsupported Grant-Control Combination

Location: /ztspecs/specs/secops/41083.md#L78

grantControls.operator is OR containing mfa plus authenticationStrength,
or simply authenticationStrength.

Microsoft documents that Require multifactor authentication and Require authentication strength cannot be configured together in the same Conditional Access policy. Authentication strength replaces the general MFA grant control for this scenario.

Reference: Conditional Access authentication strengths - limitations.

Recommendation: Remove the mfa plus authenticationStrength alternative from the specification and describe the expected operator behavior when authentication strength is combined with other supported grant controls.

[Aleksandar Nikolić (alexandair)]

Manoj Kesana (@Manoj-Kesana) Please, address my feedback.

[Aleksandar Nikolić (alexandair)]

Manoj Kesana (@Manoj-Kesana) Please, address my feedback.

[Aleksandar Nikolić (alexandair)]

LGTM