Enhance AAD Provider and Rego Code to automate checks for policy MS.AAD.3.3v1

[ssatyapal123]

🗣 Description

Updated AAD Rego code to check for MS.AAD.3.3v1: If Phishing-resistant MFA has not been enforced yet and Microsoft Authenticator is enabled, it SHALL be configured to show login context information.

Closes #410
Closes #1020

Changes in detail:

• To code this issue for policy 3.3, we needed to retrieve the authentication method configurations that were already being returned by an existing ScubaGear cmdlet Get-MgBetaPolicyAuthenticationMethodPolicy for policies 3.4 & 3.5 but the JSON structure had to be modified to support all three policies.
• The Rego was updated for policies 3.4 and 3.5 to read from the adjusted JSON structure. Unit tests and functional tests were adjusted accordingly.
• Rego policy 3.5 was adjusted since it was coded wrong - when the policy migration state is not migrationComplete it should have a Criticality of Shall/Not-Implemented to align with the baseline requirement. This results in an N/A in the report Result column.
• Products.Tests.ps1 was modified to support the case when a policy (e.g. 3.3) is N/A but has a tailored Details message instead of the generic "This product does not currently have the capability to check compliance for this policy" which only makes sense in some scenarios but not for policy 3.3.
• The Rego for new policy implementation 3.3 was coded. Unit tests and functional tests were coded as well.

💭 Motivation and context

Previously MSAAD.3.1v1 was not being checked by ScubaGear. This change adds automation by checking if MS Authenticator has the appropriate context information enabled.

🧪 Testing

Tested against E5/G5 tenant to confirm 3.3v1 passes/fails when the settings for Microsoft Authenticator are changed.

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• PR targets the correct parent branch (e.g., main or release-name) for merge.
• Changes are limited to a single goal - eschew scope creep!
• Changes are sized such that they do not touch excessive number of files.
• All future TODOs are captured in issues, which are referenced in code comments.
• These code changes follow the ScubaGear content style guide.
• Related issues these changes resolve are linked preferably via closing keywords.
• All relevant type-of-change labels added.
• All relevant project fields are set.
• All relevant repo and/or project documentation updated to reflect these changes.
• Unit tests added/updated to cover PowerShell and Rego changes.
• Functional tests added/updated to cover PowerShell and Rego changes.
• All relevant functional tests passed.
• All automated checks (e.g., linting, static analysis, unit/smoke tests) passed.

✅ Pre-merge checklist

• PR passed smoke test check.

• Feature branch has been rebased against changes from parent branch, as needed

  Use Rebase branch button below or use this reference to rebase from the command line.

• Resolved all merge conflicts on branch

• Notified merge coordinator that PR is ready for merge via comment mention

✅ Post-merge checklist

• Feature branch deleted after merge to clean up repository.
• Verified that all checks pass on parent branch (e.g., main or release-name) after merge.

[tkol2022]

@ssatyapal123

• You need to go through the pre-approval checklist at the top of the PR
• Your branch is out of date with the main branch. Rebase.
• Functional tests are missing so create a separate issue and we will add those in the next release

[tkol2022]

Test Results against E5 (bug found)

The policy produced a fail because the tenant has the "Show geographic location" disabled in the MS Authenticator settings which is correct but the message in the Details column of the report is not related to that. Needs to be fixed.

When the tenant is compliant and the test passes, the message in the report is not correct either. It is referencing policy 3.2 but your new code is for policy 3.3.

[james-garriss]

Nice work.

[tkol2022]

Nice work.

thx

[tkol2022]

@nanda-katikaneni - ready for merge