ASD.ISM-1504 - Multi-factor authentication is used to authenticate human users to their organisation's online services.
Overview
Multi-factor authentication is used to authenticate human users to their organisation's online services that process, store or communicate their organisation's sensitive data (ISM-1504, Essential Eight Maturity Level One).
A password alone is defeated by phishing, password spray and credential stuffing. Requiring a second factor for every user on every resource is the first Essential Eight requirement for multi-factor authentication, and the baseline the phishing-resistant requirement of Maturity Level Two builds on.
ASD defines which factors count, not how the policy is built, so this test runs the same check as CIS.M365.5.2.2.2. It looks for an enabled Conditional Access policy that targets all users and all resources and requires multi-factor authentication or an authentication strength. Policies that apply only at a certain risk level, exclude applications or are narrowed by a condition such as a platform or location do not count. Excluding emergency access accounts is expected.
Remediation action
- Sign in to the Microsoft Entra admin center.
- Go to Entra ID > Conditional Access > Policies and select New policy.
- Under Users, include All users. Exclude your emergency access accounts.
- Under Target resources, select All resources (formerly All cloud apps).
- Under Grant, select Grant access and Require multifactor authentication (or Require authentication strength).
- Set Enable policy to On (use Report-only first to measure the impact) and select Create.
Related links
- Essential Eight maturity model
- Essential Eight assessment process guide
- Require multifactor authentication for all users with Conditional Access
Test Metadata
| Field | Value |
|---|---|
| Test ID | ASD.ISM-1504 |
| Severity | High |
| Suite | ASD |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1110 Brute Force |
| Supports benchmark | ASD Essential Eight maturity model (version 2026.09.4), requirement ISM-1504 |
| Benchmark level | ML1 |
| Essential Eight strategy | Multi-factor authentication |
| Supports controls | essential-eight:ISM-1504, nist-800-53-r5:IA-2(2), ism:ISM-1504 |
| PowerShell test | Test-MtAsdMfaAllUsers |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
- Test:
tests/asd/entra/Test.ASD.ISM-1504.ps1 - Documentation:
tests/asd/entra/Test.ASD.ISM-1504.md