Test-Assessment-21804 flags SMS/Voice as "enabled" without checking includeTargets sign-in scoping (false positive when method is SSPR-only) #1409

Test-Assessment-21804 ("SMS and Voice Call authentication methods are disabled") fails a tenant any time the state property on the SMS or Voice authentication method configuration is enabled — regardless of whether that method is actually usable for sign-in/MFA. This produces a false positive for tenants that have deliberately enabled SMS for SSPR only, with sign-in usage explicitly turned off.

Current logic

$authMethodsPolicy = Invoke-ZtGraphRequest -RelativeUri "policies/authenticationMethodsPolicy" -ApiVersion 'v1.0'
$matchedMethods = $authMethodsPolicy.authenticationMethodConfigurations | Where-Object { $_.id -eq 'Sms' -or $_.id -eq 'Voice' }

if ($matchedMethods.state -contains 'enabled') {
    $passed = $false
}

The test only reads the top-level state field. It never inspects includeTargets[].isUsableForSignIn (or equivalent scoping) on the SMS/Voice configuration object.

Reproduction
In Entra ID → Authentication methods → Policies → SMS:

Enable: On
Use for sign-in: unchecked (for the "All users" target)

This is a valid, security-conscious configuration — SMS remains available for Self-Service Password Reset (SSPR) verification, but cannot be used to satisfy sign-in/MFA. Per Microsoft's own UI copy on that page: "SMS is usable for multi-factor authentication and Self-Service Password Reset; it can also be configured to be used as a first factor." The sign-in checkbox is the control that governs which of those uses is actually active.