Managed devices SHOULD be required for authentication

Contributed by Michael Soule with Michael Morten SonneAll contributors →

Part of CISA · Entra ID · Conditional Access · All checks

Run this check

Invoke-Maester -TestId CISA.MS.AAD.3.7

Overview

Managed devices SHOULD be required for authentication.

Rationale: The security risk of an adversary authenticating to the tenant from their own device is reduced by requiring a managed device to authenticate. Managed devices are under the provisioning and control of the agency. OMB-22-09 states, “When authorizing users to access resources, agencies must consider at least one device-level signal alongside identity information about the authenticated user.”

Remediation action:

Create a Conditional Access policy requiring a user’s device to be either Microsoft Entra hybrid joined or compliant during authentication. Configure the following policy settings in the new Conditional Access policy, per the values below:

1. In Entra under Protection and Conditional Access, select Policies.
2. Click on New policy
3. Under New Conditional Access policy, configure the following policy settings in the new Conditional Access policy, per the values below:
   • Users > Include > All users
   • Target resources > Cloud apps > All cloud apps
   • Access controls > Grant > Grant Access > Require device to be marked as compliant and Require Microsoft Entra hybrid joined device > For multiple controls > Require one of the selected controls
4. Click Save.

Related links

• Entra admin center - Conditional Access | Policies
• CISA Strong Authentication & Secure Registration - MS.AAD.3.7v1
• CISA ScubaGear Rego Reference

Details

Every attribute of this check

Field	Value
Test ID	CISA.MS.AAD.3.7
Severity	Medium
Suite	CISA
Product	Entra ID
Feature	Conditional Access
Area	Access control
Resource type	Tenant
User impact	High
Implementation cost	High
MITRE ATT&CK	T1078.004 Cloud Accounts
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.3.7
Criticality	SHOULD
Upstream requirement	MS.AAD.3.7v1
Supports controls	cisa-scuba:MS.AAD.3.7, nist-800-53-r5:AC-20b, nist-800-53-r5:IA-3
PowerShell test	Test-MtCisaManagedDevice
Services	Graph
Compatible licenses	AAD_PREMIUM

Source

• Test: tests/cisa/entra/Test.CISA.MS.AAD.3.7.ps1
• Documentation: tests/cisa/entra/Test.CISA.MS.AAD.3.7.md