Phishing-resistant MFA SHALL be enforced for all users
Part of CISA · Entra ID · Conditional Access · All checks
Invoke-Maester -TestId CISA.MS.AAD.3.1Overview
Section titled “Overview”Phishing-resistant MFA SHALL be enforced for all users.
Rationale: Weaker forms of MFA do not protect against sophisticated phishing attacks. By enforcing methods resistant to phishing, those risks are minimized.
The test passes when an enabled Conditional Access policy for all users and all cloud apps requires the built-in Phishing-resistant MFA authentication strength, or a custom authentication strength limited to Windows Hello for Business, passkeys (FIDO2) and certificate-based multifactor authentication.
Remediation action:
Section titled “Remediation action:”Create a Conditional Access policy enforcing phishing-resistant MFA for all users. Configure the following policy settings in the new Conditional Access policy, per the values below:
- Users > Include > All users
- Target resources > Cloud apps > All cloud apps
- Access controls > Grant > Grant Access > Require authentication strength > Phishing-resistant MFA
Related links
Section titled “Related links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | CISA.MS.AAD.3.1 |
| Severity | High |
| Suite | CISA |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | High |
| Implementation cost | High |
| MITRE ATT&CK | T1566.002 Spearphishing Link |
| Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.3.1 |
| Criticality | SHALL |
| Upstream requirement | MS.AAD.3.1v1 |
| Supports controls | cisa-scuba:MS.AAD.3.1, nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2), nist-800-53-r5:IA-5c, nist-800-53-r5:IA-5g, nist-800-53-r5:IA-2(8) |
| PowerShell test | Test-MtCisaPhishResistant |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
Section titled “Source”- Test:
tests/cisa/entra/Test.CISA.MS.AAD.3.1.ps1 - Documentation:
tests/cisa/entra/Test.CISA.MS.AAD.3.1.md