MT.1019: At least one Conditional Access policy is configured to enable application enforced restrictions.
| ID | MT.1019 |
| Severity | Medium |
| Suite | Mito |
| Product | Entra ID |
| Related products | SharePoint, Exchange Online |
| Feature | Conditional Access |
| Security area | Access control |
| Resource type | Tenant |
| User impact of fixing | Medium |
| Effort to fix | Medium |
| MITRE ATT&CK | T1213.002, T1530 |
| Reads from | Microsoft Graph |
| Licence needed | AAD_PREMIUM |
What this checks and how to fix it
Section titled “What this checks and how to fix it”A Conditional Access policy with application-enforced restrictions can help minimize the risk of data leakage from a shared device.
Learn more: https://aka.ms/CATemplatesAppRestrictions
Remediation action
Section titled “Remediation action”Review the configuration described above.
Mito check. Author: f-bader; contributors: thomas-s-schmidt. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.