What it decides

Rule
ENTRA-AUTH-006
Applies to
entra · authorization-policy
Default severity
medium
Basis
documented-guidance

On what authority

Microsoft documents the setting and its exact reach: "To disable the use of MSOL PowerShell, set this property to `true`. This also disables user-based access to the legacy service endpoint used by MSOL PowerShell. This doesn't affect Microsoft Entra Connect or Microsoft Graph." THE SECOND SENTENCE IS WHY THIS IS WORTH READING. What the flag closes is not only a module: it is user-based access to a legacy endpoint. And the third sentence is why closing it is usually available -- the paths an organisation actually depends on, Entra Connect and Graph, are documented as unaffected. Microsoft states the mechanism rather than recommending a value, so this reports what the setting leaves reachable and does not say it is wrong.

What it needs to decide

  • authorization_policy.msol_powershell_blocked

Without these facts the rule answers unknown, which is not a pass and is not a failure: it is the rule saying the evidence could not settle the question.

Where the evidence comes from

  • tenant-governance: what every user in a tenant may do without asking, and how many accounts hold the role that may do anything · live-validated

What a pass does not establish

BLOCKED IS NOT UNTOUCHED. A pass says the door is shut now. It says nothing about what was done through it while it was open, and nothing about whether a script somewhere still expects it.

  • This reads one tenant-level setting. Whether any other legacy authentication surface remains reachable is a separate question, and a pass here is not an answer to it.

Source

The rule as the Engine holds it, at the revision this page was generated from: 1.0.0b10@0c269e9d29d0.

Generated from capability-manifest/1.0.0 at 1.0.0b10@0c269e9d29d0, contract 1.0.0b10. Every fact on this page is the Engine's; this site publishes it and does not maintain it.