CIS.M365.5.2.2.10 - (L1) Ensure a managed device is required to register security information
Overview
An enabled Conditional Access policy requires a compliant device (or, as an alternative, a hybrid joined device) when users register or change their security information.
An attacker who has a password and can register their own authentication method controls the account from then on. Limiting registration to managed devices stops that persistence step from an unmanaged machine.
The policy applies to the register security information user action rather than to apps. Users who need to register from a new device can use a temporary access pass from a managed device or the office network.
User and group exclusions are not evaluated by this test. Application exclusions are also not evaluated when the policy targets all apps; verify exclusions are documented and reviewed annually. A condition that narrows the policy is reported unless the check is about that condition.
Remediation action
- Sign in to the Microsoft Entra admin center.
- Go to Entra ID > Conditional Access > Policies and select New policy.
- Under Users, include All users. Exclude your emergency access accounts.
- Under Target resources, select User actions and then Register security information.
- Under Grant, select Grant access, then Require device to be marked as compliant and optionally Require Microsoft Entra hybrid joined device. Choose Require one of the selected controls.
- Set Enable policy to On (use Report-only first to measure the impact) and select Create.
Related links
- Microsoft Entra admin center - Conditional Access policies
- Conditional Access policy to secure security information registration
- Conditional Access: user actions
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.2.10
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.2.2.10 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1098.005 Device Registration |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.2.10 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.2.2.10, nist-800-53-r5:IA-3 |
| PowerShell test | Test-MtCisManagedDeviceForSecurityInfo |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
- Test:
tests/cis/Test.CIS.M365.5.2.2.10.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.2.2.10.md