CA policy for pim-strong-reauth-compliant-device

gistfile1.txt

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies/$entity",
  "id": "876aef31-50a3-4c79-b77a-7ba8f8941317",
  "createdDateTime": "2024-09-06T01:23:30.5342067Z",
  "displayName": "PIM - Require strong re-authentication from compliant device",
  "state": "enabledForReportingButNotEnforced",
  "conditions": {
    "clientAppTypes": [ "all" ],
    "signInRiskLevels": [ ],
    "userRiskLevels": [ ],
    "applications": {
      "excludeApplications": [ ],
      "includeApplications": [ ],
      "includeAuthenticationContextClassReferences": [ "c1" ],
      "includeUserActions": [ ]
    },
    "users": {
      "excludeGroups": [ ],
      "excludeRoles": [ ],
      "excludeUsers": [ ],
      "includeGroups": [ ],
      "includeRoles": [ ],
      "includeUsers": [ "All" ]
    }
  },
  "grantControls": {
    "[email protected]": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies(\u0027876aef31-50a3-4c79-b77a-7ba8f8941317\u0027)/grantControls/authenticationStrength/$entity",
    "builtInControls": [ "compliantDevice" ],
    "customAuthenticationFactors": [ ],
    "operator": "AND",
    "termsOfUse": [ ],
    "authenticationStrength": {
      "[email protected]": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies(\u0027876aef31-50a3-4c79-b77a-7ba8f8941317\u0027)/grantControls/authenticationStrength/combinationConfigurations",
      "id": "00000000-0000-0000-0000-000000000004",
      "allowedCombinations": [ "windowsHelloForBusiness", "fido2", "x509CertificateMultiFactor" ],
      "createdDateTime": "2021-12-01T08:00:00.0000000Z",
      "description": "Phishing-resistant, Passwordless methods for the strongest authentication, such as a FIDO2 security key",
      "displayName": "Phishing-resistant MFA",
      "modifiedDateTime": "2021-12-01T08:00:00.0000000Z",
      "policyType": "builtIn",
      "requirementsSatisfied": "mfa",
      "combinationConfigurations": [ ]
    }
  },
  "sessionControls": {
    "signInFrequency": {
      "isEnabled": true,
      "authenticationType": "primaryAndSecondaryAuthentication",
      "frequencyInterval": "everyTime"
    }
  }
}