CIS.M365.5.2.2.2 - (L1) Ensure multifactor authentication is enabled for all users
Overview
An enabled Conditional Access policy requires multifactor authentication for all users, in all cloud apps.
Passwords are the most common way into Microsoft 365 accounts: they are phished, reused, guessed and sprayed. Requiring a second factor for every user at sign-in blocks most of these attacks even when the password is known.
The policy must target all users and all resources, require MFA or an authentication strength, and be enabled. Policies that apply only at a certain risk level, or that are in report-only mode, do not satisfy the test. Excluding emergency access accounts is expected.
User and group exclusions are not evaluated by this test. Application exclusions are also not evaluated when the policy targets all apps; verify exclusions are documented and reviewed annually. A condition that narrows the policy is reported unless the check is about that condition.
Remediation action
- Sign in to the Microsoft Entra admin center.
- Go to Entra ID > Conditional Access > Policies and select New policy.
- Under Users, include All users. Exclude your emergency access accounts.
- Under Target resources, select All resources (formerly All cloud apps).
- Under Grant, select Grant access and Require multifactor authentication (or Require authentication strength).
- Set Enable policy to On (use Report-only first to measure the impact) and select Create.
Related links
- Microsoft Entra admin center - Conditional Access policies
- Require multifactor authentication for all users with Conditional Access
- Plan a Conditional Access deployment
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.2.2
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.2.2.2 |
| Severity | High |
| Suite | CIS |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1110 Brute Force |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.2.2 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.2.2.2, nist-800-53-r5:IA-2(2) |
| PowerShell test | Test-MtCisMfaForEveryUser |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
- Test:
tests/cis/Test.CIS.M365.5.2.2.2.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.2.2.2.md