ASD.ISM-1872 - Multi-factor authentication used for authenticating human users of online services is phishing-resistant.
Overview
Multi-factor authentication used for authenticating human users of online services is phishing-resistant (ISM-1872, Essential Eight Maturity Level Two).
Push notifications, one-time codes and SMS are relayed by adversary-in-the-middle phishing kits in real time. Passkeys (FIDO2), Windows Hello for Business and certificate-based authentication bind the sign-in to the site, so a proxied page gets nothing it can replay.
ASD's assessment guide applies this requirement to unprivileged and privileged users alike, and the ASD Blueprint for Secure Cloud meets it with one Conditional Access policy for all users and all resources that requires the Phishing-resistant MFA authentication strength. This test runs the same check as CISA.MS.AAD.3.1: an enabled policy that targets all users and all resources and requires the built-in Phishing-resistant MFA strength, or a custom strength limited to Windows Hello for Business, passkeys (FIDO2) and certificate-based multifactor authentication.
Remediation action
- Register phishing-resistant methods for your users: enable Passkey (FIDO2) and Certificate-based authentication under Entra ID > Authentication methods, and deploy Windows Hello for Business to managed devices.
- In Entra ID > Conditional Access, create a policy with Users > All users (exclude your emergency access accounts), Target resources > All resources, and Grant > Require authentication strength > Phishing-resistant MFA.
- Roll it out by group, starting with administrators, before you target all users.
Related links
- Essential Eight maturity model
- ASD Blueprint for Secure Cloud: Require strong auth
- Conditional Access authentication strength
- Phishing-resistant passwordless authentication deployment
Test Metadata
| Field | Value |
|---|---|
| Test ID | ASD.ISM-1872 |
| Severity | High |
| Suite | ASD |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | High |
| Implementation cost | High |
| MITRE ATT&CK | T1566.002 Spearphishing Link |
| Supports benchmark | ASD Essential Eight maturity model (version 2026.09.4), requirement ISM-1872 |
| Benchmark level | ML2 |
| Essential Eight strategy | Multi-factor authentication |
| Supports controls | essential-eight:ISM-1872, ism:ISM-1872 |
| PowerShell test | Test-MtAsdPhishingResistantMfa |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
- Test:
tests/asd/entra/Test.ASD.ISM-1872.ps1 - Documentation:
tests/asd/entra/Test.ASD.ISM-1872.md