Update AAD MS.AAD.3.2v1 to be dependent on MS.AAD.3.1v1

[tkol2022]

💡 Summary

Update the Rego code for MS.AAD.3.2v1 If Phishing-resistant MFA has not been enforced yet, then an alternative MFA method SHALL be enforced for all users to be dependent on MS.AAD.3.1v1 Phishing-resistant MFA SHALL be enforced for all users.

• If policy MS.AAD.3.1v1 Passes, then this policy MS.AAD.3.2v1 will automatically Pass. See the way the OneDrive expiration date for Anyone links is dependent on a different setting for an example.
• If policy MS.AAD.3.1v1 Fails, then the existing Rego code for MS.AAD.3.2v1 should be applied to evaluate the policy (i.e. checking for a conditional access policy that requires MFA but does not dictate the specific type of MFA). See the instructions section as a reference for the conditional access policy template but again this code already exists in the Rego.

dependsOn #433

Acceptance criteria

How do we know when this work is done?

• Test the code for all possible value combinations of MS.AAD.3.1v1 and MS.AAD.3.2v1 to ensure that the report produces an accurate Pass or Fail
• Test in all tenants

[crutchfield]

Closed with #441