MT.1035: All security groups assigned to Conditional Access Policies should be protected by RMAU.

ID	MT.1035
Severity	High
Suite	Mito
Product	Entra ID
Feature	Conditional Access
Security area	Privileged access
Resource type	Group
User impact of fixing	Low
Effort to fix	Medium
Framework controls	nist-800-53-r5:AC-6 Least Privilege nist-800-53-r5:AC-3 Access Enforcement
MITRE ATT&CK	T1098, T1556.009
Reads from	Microsoft Graph
Licence needed	AAD_PREMIUM

What this checks and how to fix it

Security Groups will be used to exclude and include users from Conditional Access Policies. Modify group membership outside of Conditional Access Administrator or other privileged roles can lead to bypassing Conditional Access Policies.

To prevent this, you can protect these groups by using Restricted Management Administrative Units or Role Assignable Groups. Role Assignable Group should be used in combination of assignments to Entra ID roles. Restricted Management Administrative Units should be used to protect groups by restricting management to specific users or groups. This test checks if all groups used in Conditional Access Policies are protected.

See Restricted management administrative units in Microsoft Entra ID - Microsoft Entra ID | Microsoft Learn

---

Mito check. Author: Cloud-Architekt; contributors: thomas-s-schmidt. Open-source licences.