RELOPS-2513: document stronger MFA policy for Store publishers

[markcor]

Summary

• document the authentication strength and Partner Center Conditional Access policy created manually in Microsoft Entra
• retain the intended Terraform configuration as conditional_access.tf.example
• keep the example inactive until the manually created resources can be imported through an authorized Terraform workflow

Live configuration

The Partner Center - require authenticator app policy targets the Microsoft Store Publishers group and Microsoft Partner Center application fabfbdc4-5751-471c-ac43-3826fa1afc31.

It requires Authenticator push, software OATH/TOTP, Authenticator passwordless, Windows Hello, or FIDO2. SMS, voice, and email do not satisfy the authentication strength.

The policy is Report-only. It will be monitored for expected passes, remediation needs, and unintended impact before enforcement.

Terraform behavior

Terraform ignores files ending in .tf.example. A live Terraform plan after this change returned:

No changes. Your infrastructure matches the configuration.

The example must not be renamed to .tf until both manually created resources are imported into Terraform state.

Follow-up work

• RELOPS-2561: Improve Azure security posture
• RELOPS-2559: Lock down MFA for Microsoft Entra administrator roles
• RELOPS-2562: Develop a Terraform workflow for Azure security policies
• RELOPS-2560: Audit inherited Microsoft Entra configuration and import it into Terraform

Jira: https://mozilla-hub.atlassian.net/browse/RELOPS-2513

[markcor]

Terraform plan completed successfully against the live Azure AD workspace.

Plan: 2 to add, 0 to change, 0 to destroy.

Creates only:

• azuread_authentication_strength_policy.authenticator_app
• azuread_conditional_access_policy.ms_store_partner_center

The Conditional Access policy state is enabledForReportingButNotEnforced, so it will collect report-only results without blocking sign-ins. No group memberships, access assignments, or existing resources are changed or destroyed.

One unrelated existing warning remains: azuread_directory_role_member.ci_billing_billing_admin is deprecated.

[markcor]

Apply attempt update:

Terraform reached Microsoft Graph but failed before creating the authentication strength:

unexpected status 403 (403 Forbidden)
accessDenied: Request Authorization failed

The authenticated user has an active Global Administrator role. The failure is the Azure CLI authentication token: its first-party client does not include the Policy.ReadWrite.ConditionalAccess delegated scope required by the authentication-strength API.

Remote state was checked after the failure. Neither azuread_authentication_strength_policy.authenticator_app nor azuread_conditional_access_policy.ms_store_partner_center is present, so no resources or access settings changed.

Apply requires Terraform authentication through a service principal or managed identity granted Microsoft Graph Policy.ReadWrite.ConditionalAccess and Policy.Read.All application permissions with admin consent.

[markcor]

Additional authorization finding:

The signed-in user has an active Global Administrator role, but the Azure CLI first-party application's OAuth token does not carry the Policy.ReadWrite.ConditionalAccess delegated scope required by Microsoft Graph's authentication-strength API. The role and token scope are separate authorization checks; Global Administrator alone cannot compensate for a missing scope in the calling application's token.

This matches Azure CLI issue:
Azure/azure-cli#33062

The failed apply was safe: Microsoft Graph rejected the first create request, and a subsequent remote-state check confirmed that neither planned resource was added. No tenant configuration or access changed.

Next attempt should use a service principal or managed identity with admin-consented Microsoft Graph application permissions Policy.ReadWrite.ConditionalAccess and Policy.Read.All, followed by a fresh plan.