Network-25396: Conditional Access policies enforce strong authentication for private apps

[praneeth-0000]

Added test for 25396

Conditional Access policies enforce strong authentication for private apps

[Copilot]

Pull request overview

This PR adds a new security assessment test (ID: 25396) that validates whether Conditional Access policies enforce strong authentication methods for Private Access applications within Microsoft Entra Global Secure Access.

Key changes:

• Implements comprehensive test logic to evaluate Private Access applications (both Per-app and Quick Access types) for CA policy coverage requiring MFA or authentication strength
• Introduces sophisticated authentication strength classification (Phishing-Resistant, Passwordless MFA, MFA baseline)
• Provides detailed reporting with manual review capability for apps protected via applicationFilter-based policies

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/powershell/tests/Test-Assessment.25396.ps1	New test function that queries Private Access apps, evaluates CA policy coverage, classifies authentication strength levels, and generates detailed compliance reports with pass/fail/investigate status
src/powershell/tests/Test-Assessment.25396.md	Documentation explaining security risks of unprotected private apps and providing remediation guidance with links to Microsoft Learn articles

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.