Managed Devices SHOULD be required to register MFA

Contributed by Michael Soule with Michael Morten SonneAll contributors →

Part of CISA · Entra ID · Conditional Access · All checks

Run this check

Invoke-Maester -TestId CISA.MS.AAD.3.8

Overview

Managed Devices SHOULD be required to register MFA.

Rationale: Reduce risk of an adversary using stolen user credentials and then registering their own MFA device to access the tenant by requiring a managed device provisioned and controlled by the agency to perform registration actions. This prevents the adversary from using their own unmanaged device to perform the registration.

Remediation action:

Create a Conditional Access policy requiring a user to be on a managed device when registering for MFA.

1. In Entra under Protection and Conditional Access, select Policies.
2. Click on New policy
3. Under New Conditional Access policy, configure the following policy settings in the new Conditional Access policy, per the values below:
   • Users > Include > All users
   • Target resources > User actions > Register security information
   • Access controls > Grant > Grant Access > Require device to be marked as compliant and Require Microsoft Entra hybrid joined device > For multiple controls > Require one of the selected controls
4. Click Save.

Related links

• Entra admin center - Conditional Access | Policies
• CISA Strong Authentication & Secure Registration - MS.AAD.3.8v1
• CISA ScubaGear Rego Reference

Details

Every attribute of this check

Field	Value
Test ID	CISA.MS.AAD.3.8
Severity	Medium
Suite	CISA
Product	Entra ID
Feature	Conditional Access
Area	Authentication
Resource type	Tenant
User impact	Medium
Implementation cost	Medium
MITRE ATT&CK	T1078.004 Cloud Accounts, T1098.005 Device Registration
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.3.8
Criticality	SHOULD
Upstream requirement	MS.AAD.3.8v1
Supports controls	cisa-scuba:MS.AAD.3.8, nist-800-53-r5:AC-20b, nist-800-53-r5:IA-3
PowerShell test	Test-MtCisaManagedDeviceRegistration
Services	Graph
Compatible licenses	AAD_PREMIUM

Source

• Test: tests/cisa/entra/Test.CISA.MS.AAD.3.8.ps1
• Documentation: tests/cisa/entra/Test.CISA.MS.AAD.3.8.md