Discovery for Entra ID Persistence Vulnerabilities

The following table describes the vulnerabilities identified in the pre-defined Entra Discovery for Persistence.

NOTE: Persistence techniques are used by adversaries to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access.

Vulnerability Template Vulnerability Risk What to find
Entra ID Conditional Access cloud application inclusion status

Name:

Entra ID cloud applications that are not included in a conditional access policy

Default scope:

All Applications

 

 

Conditional Access policies allow administrators to assign controls to specific applications. Administrators can choose from the list of applications or services that include built-in Microsoft applications and any Microsoft Entra integrated applications. Ensure at least one conditional access policy applies to each Cloud application in the organization.

Remediation:

Enable a Conditional Access policy for the tenant that has "Target resources" set to include any cloud application that are not currently included in a Conditional Access policy.

 Entra ID Cloud applications in scope that are not included in a conditional access policy