Scuba Config Analyzer incorrectly recommends a Conditional Access Policy for MS.AAD.7.4v1 #2540

Prerequisites

• This issue has an informative and human-readable title.

ScubaGear Version

2.0.0

Operating System

Windows 11

PowerShell Version

5.1

M365 Environment and License(s)

All

🐛 Summary

Start-SCuBAConfigAnalyzer displays incorrect remediation guidance for MS.AAD.7.4v1 when importing a ScubaGear results file.

The analyzer recommends creating a Conditional Access policy, although this control concerns permanent active assignments to highly privileged roles and remediation through PIM or an alternative PAM system.

Connect & Scan also appears to show different configuration availability for the same control. This should be investigated for consistency with the imported-results workflow.

Steps to reproduce

Steps to Reproduce

1. Generate ScubaGear results containing a failure for MS.AAD.7.4v1.
2. Open Start-SCuBAConfigAnalyzer.
3. Select Load Results JSON and import the results.
4. Select MS.AAD.7.4v1 in the Findings list.
5. Review the root cause, recommended action, and Control YAML.
6. Compare the finding with Connect & Scan against the same tenant.

Expected behavior

The imported finding displays:

“No Conditional Access policy addresses this baseline - create a new one.”
Action: CREATE_POLICY.
“No matching Conditional Access policy exists for this control - create one from scratch.”

The screenshot also shows RoleExclusions in the Control YAML, while the recommendations describe Conditional Access. The step-by-step remediation describes role-assignment changes, making the guidance internally inconsistent.

Import scubaresults:

When connected:

Connect & Scan reportedly presents different configuration availability. Attach its exact message and screenshot for comparison.

• Classify MS.AAD.7.4v1 as a privileged-role assignment control, not a Conditional Access control.
• Recommend replacing unjustified permanent active assignments with expiring assignments through PIM or an alternative PAM system.
• Explain the documented exceptions for emergency access accounts, service accounts, and qualifying PIM-managed groups.
• Recognize that a group enrolled in PIM for Groups can have a permanent active role assignment because activation is managed through PIM for Groups.
• Do not assume every group qualifies for that exception; use available enrollment evidence or indicate when verification is required.
• Present consistent configurability and appropriate RoleExclusions guidance across imported results and live scans.

Output from Install-ScubaDependencies (optional)

All modules installed