CIS.M365.5.2.2.1 - (L1) Ensure multifactor authentication is enabled for all users in administrative roles
Overview
An enabled Conditional Access policy requires multifactor authentication for the privileged directory roles, in all cloud apps.
Administrator accounts can change identity, mail and security configuration for the whole organisation. A password alone is enough for an attacker who phished or sprayed it. Requiring MFA at sign-in for these roles makes a stolen password insufficient.
The test passes when one enabled policy lists every role in the set that the test checks: Application, Authentication, Billing, Cloud Application, Conditional Access, Exchange, Global, Helpdesk, Password, Privileged Authentication, Privileged Role, Security, SharePoint and User Administrator roles, plus Global Reader. Policies in report-only mode do not count. Keep emergency access accounts in the policy exclusions.
User and group exclusions are not evaluated by this test. Application exclusions are also not evaluated when the policy targets all apps; verify exclusions are documented and reviewed annually. A condition that narrows the policy is reported unless the check is about that condition.
Remediation action
- Sign in to the Microsoft Entra admin center.
- Go to Entra ID > Conditional Access > Policies and select New policy.
- Under Users, select Include > Select users and groups > Directory roles and add every role listed above. Exclude your emergency access accounts.
- Under Target resources, select All resources (formerly All cloud apps).
- Under Grant, select Grant access and Require multifactor authentication (or Require authentication strength).
- Set Enable policy to On (use Report-only first to measure the impact) and select Create.
Related links
- Microsoft Entra admin center - Conditional Access policies
- Require multifactor authentication for administrators with Conditional Access
- Plan a Conditional Access deployment
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.2.1
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.2.2.1 |
| Severity | High |
| Suite | CIS |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Privileged access |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1110.003 Password Spraying |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.2.1 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.2.2.1, nist-800-53-r5:IA-2(1) |
| PowerShell test | Test-MtCisMfaForAdminRole |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
- Test:
tests/cis/Test.CIS.M365.5.2.2.1.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.2.2.1.md