CIS.M365.5.2.2.17 - (L1) Ensure authentication transfer is blocked
Overview
An enabled Conditional Access policy blocks the authentication transfer flow for all users and all cloud apps.
Authentication transfer lets a signed-in session on one device start a session on another device, for example from a desktop browser to a mobile app. The second device inherits the trust of the first without its own sign-in, which attackers can abuse by getting a victim to scan a QR code.
Blocking the flow forces every device to sign in on its own and so to meet its own Conditional Access requirements.
User and group exclusions are not evaluated by this test. Application exclusions are also not evaluated when the policy targets all apps; verify exclusions are documented and reviewed annually. A condition that narrows the policy is reported unless the check is about that condition.
Remediation action
- Sign in to the Microsoft Entra admin center.
- Go to Entra ID > Conditional Access > Policies and select New policy.
- Under Users, include All users. Exclude your emergency access accounts.
- Under Target resources, select All resources (formerly All cloud apps).
- Under Conditions > Authentication flows, set Configure to Yes and select Authentication transfer.
- Under Grant, select Block access.
- Set Enable policy to On (use Report-only first to measure the impact) and select Create.
Related links
- Microsoft Entra admin center - Conditional Access policies
- Block authentication flows with Conditional Access
- Conditional Access: authentication flows
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.2.17
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.2.2.17 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.2.17 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.2.2.17, nist-800-53-r5:CM-7 |
| PowerShell test | Test-MtCisBlockAuthenticationTransfer |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
- Test:
tests/cis/Test.CIS.M365.5.2.2.17.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.2.2.17.md