Add test MT.1106 to verify Protected Actions Auth Contexts have CA policies

[Copilot]

Description

Fixes the issue where Protected Actions with Authentication Contexts assigned may not actually be protected if the context isn't referenced by any Conditional Access policy. Without a CA policy enforcing the auth context, users aren't prompted for step-up authentication.

Fixes #997

Changes:

• Test-MtCaAuthContextProtectedActionsExist.ps1 - New test function that:
  • Fetches auth contexts from identity/conditionalAccess/authenticationContextClassReferences
  • Checks PIM role management policies for unifiedRoleManagementPolicyAuthenticationContextRule rules (with isEnabled check)
  • Compares against enabled CA policies' includeAuthenticationContextClassReferences
  • Fails if any auth context used in Protected Actions lacks a CA policy reference
  • Detects deleted auth contexts by iterating over protected action contexts and showing "(Deleted or not found)" for missing contexts
• Test-MtCaAuthContextProtectedActionsExist.md - Function documentation
• Test-ConditionalAccessBaseline.Tests.ps1 - Added MT.1106 test case
• MT.1106.md - Website documentation

# Example usage
Test-MtCaAuthContextProtectedActionsExist
# Returns $true if all Protected Action auth contexts have CA policies
# Returns $false with details table if any are unprotected

Contribution Checklist

Before submitting this PR, please confirm you have completed the following:

• 📖 Read the guidelines for contributing to this repository.
• 🧪 Ensure the build and unit tests pass by running /powershell/tests/pester.ps1 on your local system.

 

Join us at the Maester repository discussions 💬 or Entra Discord 🧑‍💻 for more help and conversations!

Original prompt

---

This section details on the original issue you should resolve

<issue_title>🙏Maester Test to Ensure all Protected Actions Auth Context have a conditional access referenced.</issue_title>
<issue_description>Maester Test to Ensure all Protected Actions Auth Context have a conditional access referenced.

Maester Test to Ensure all Protected Actions Auth Context have a conditional access referenced. There is a potential for an auth context to get deleted while still being referenced in a CA

If no Conditional access Policy is referenced by the authentication context then the protected action is not well protecting anything

</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes 🙏Maester Test to Ensure all Protected Actions Auth Context have a conditional access referenced. #997

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[cloudflare-workers-and-pages]

Deploying maester with    Cloudflare Pages

Latest commit:	6f5ed1f
Status:	✅  Deploy successful!
Preview URL:	https://bca10008.maester.pages.dev
Branch Preview URL:	https://copilot-add-maester-test-con.maester.pages.dev

View logs

[Copilot]

Pull request overview

Adds a new validation test to ensure that protected actions using Authentication Contexts are actually enforced by Conditional Access policies, plus associated documentation and baseline test wiring.

• Introduces Test-MtCaAuthContextProtectedActionsExist to detect Authentication Contexts used by Protected Actions but not referenced by any CA policy.
• Wires the test into the Conditional Access baseline suite (MT.1090).
• Adds user-facing documentation for the test and website page.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
website/docs/tests/maester/MT.1090.md	New website doc explaining MT.1090 test purpose, remediation steps, and links.
tests/Maester/Entra/Test-ConditionalAccessBaseline.Tests.ps1	Adds the MT.1090 test case to the Entra Conditional Access baseline suite.
powershell/public/maester/entra/Test-MtCaAuthContextProtectedActionsExist.ps1	Implements the test logic to correlate protected actions’ Authentication Contexts with CA policies.
powershell/public/maester/entra/Test-MtCaAuthContextProtectedActionsExist.md	Adds command documentation with remediation steps and related links.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[SamErde]

The test ID 'MT.1090' is already taken. 'MT.1106' should be used for this test. References within this PR need to be changed accordingly.

[Copilot]

The test ID 'MT.1090' is already taken. 'MT.1106' should be used for this test. References within this PR need to be changed accordingly.

Renamed to MT.1106 in commit 550d061. Updated the website doc, test file reference, title, and slug accordingly.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.