Device registration MFA control conflicts with Conditional Access policies

Contributed by Robbe Van den Daele with Thomas SchmidtAll contributors →

Part of Maester · Entra ID · Conditional Access · All checks

Run this check

Invoke-Maester -TestId MT.1061

Overview

When MFA is required during device registration in Conditional Access policies, it must be disabled in the Entra ID Device settings.

When both are enabled, the Conditional Access policy with the “Register or join devices” user action will not work as expected.

Remediation action

When a Conditional Access policy is configured with the Register or join devices user action you must disable tenant-wide multifactor requirement for device registration. Otherwise, Conditional Access policies with this user action are not properly enforced.

1. Open Entra - Device Settings.
2. Set Require Multifactor Authentication to register or join devices with Microsoft Entra to No.

Related links

• Require multifactor authentication for device registration
• Conflicting Conditional Access policies and Entra Device Settings

Details

Every attribute of this check

Field	Value
Test ID	MT.1061
Severity	Medium
Suite	Maester
Product	Entra ID
Feature	Conditional Access
Area	Authentication
Resource type	ConditionalAccessPolicy
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1098.005 Device Registration
PowerShell test	Test-MtDeviceRegistrationMfaConflict
Services	Graph

Source

• Test: tests/maester/entra/Test.MT.1061.ps1
• Documentation: tests/maester/entra/Test.MT.1061.md