MT.1006: At least one Conditional Access policy is configured to require MFA for admins.

ID	MT.1006
Severity	High
Suite	Mito
Product	Entra ID
Feature	Conditional Access
Security area	Privileged access
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Low
Framework controls	nist-800-53-r5:IA-2(1) Identification and Authentication (Organizational Users) | Multi-factor Authentication to Privileged Accounts
MITRE ATT&CK	T1078.004, T1110
Reads from	Microsoft Graph
Licence needed	AAD_PREMIUM

What this checks and how to fix it

This test checks if the tenant has at least one Conditional Access policy requiring MFA for admins. The following roles are considered as admin roles:

• Global Administrator
• Application Administrator
• Authentication Administrator
• Billing Administrator
• Cloud Application Administrator
• Conditional Access Administrator
• Exchange Administrator
• Helpdesk Administrator
• Password Administrator
• Privileged Authentication Administrator
• Privileged Role Administrator
• Security Administrator
• SharePoint Administrator
• User Administrator

See Require MFA for administrators - Microsoft Learn”

---

Mito check. Author: f-bader; contributors: RetroDadson, SamErde. Open-source licences.