Conditional Access Policy not being recognized as implemented

Question

Conditional Access Policy not being recognized as implemented

Andrew Roper 0

Whenever I get the Threat Analytics report from MS, I check them out. Most times, I am not affected. But, just recently, there was a report that required some CAPs enabled to mitigate said threat. I viewed the recommendations, and it is suggesting that I enable 3 CAPs. However, those CAPs are already configured and deployed to all my users. Why isn't this being recognized so that I no longer see it as a recommendation and get the points for my security score?

Gudivada Adi Navya Sri 21,095 Reputation points Moderator

2024-10-22T15:15:27.33+00:00
Hi @Andrew Roper

Thank you for posting this in Microsoft Q&A.

We have noticed that this issue has occurred for many customers since October 4th, affecting all users in the tenant.

The affected recommendations with score regression is mentioned below:

Use least privileged administrative roles

Designate more than one global admin

Ensure multifactor authentication is enabled for all users in administrative roles

Ensure the 'Password expiration policy' is set to 'Set passwords to never expire (recommended)'

Ensure user consent for apps accessing company data on their behalf is not allowed.

My team has investigated this issue, and a hotfix is being rolled out. Correct data will be generated and available on some scores.

Can you please check and let me know whether you are able to see the correct data or not?

Hope this helps. Do let us know if you any further queries.

Thanks,

Navya.
Gudivada Adi Navya Sri 21,095 Reputation points Moderator

2024-11-05T14:30:49.8166667+00:00

Hi @Andrew Roper

Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.