CIS.M365.5.2.2.5 - (L2) Ensure 'Phishing-resistant MFA strength' is required for Administrators
Overview
An enabled Conditional Access policy requires the phishing-resistant MFA authentication strength for the administrative roles.
Push notifications, SMS and one-time codes can be relayed by an adversary-in-the-middle phishing site. Phishing-resistant methods bind the sign-in to the real site, so a relayed prompt does not work. Administrators are the highest-value targets, so they are the first accounts to move to these methods.
Users need a registered FIDO2 security key, Windows Hello for Business or a certificate before the policy is enabled for them, otherwise they are locked out. Roll out in report-only mode and keep emergency access accounts excluded.
The allowed combinations must be a non-empty subset of Windows Hello for Business, FIDO2 or certificate-based multifactor authentication. It does not need to include all three, and any other method makes the check fail.
Policies with sign-in-risk or user-risk conditions are not evaluated by this test, so narrowing conditions on those policies are not reported. User and group exclusions are not evaluated by this test. Application exclusions are also not evaluated when the policy targets all apps; verify exclusions are documented and reviewed annually. For policies this test evaluates, a condition that narrows the policy is reported unless the check is about that condition.
Remediation action
- Sign in to the Microsoft Entra admin center.
- Go to Entra ID > Conditional Access > Policies and select New policy.
- Under Users, select Directory roles and add the administrative roles. Exclude your emergency access accounts.
- Under Target resources, select All resources (formerly All cloud apps).
- Under Grant, select Grant access and Require authentication strength, then choose Phishing-resistant MFA.
- Set Enable policy to On (use Report-only first to measure the impact) and select Create.
Related links
- Microsoft Entra admin center - Conditional Access policies
- Require phishing-resistant multifactor authentication for administrators
- Conditional Access authentication strength
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.2.5
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.2.2.5 |
| Severity | High |
| Suite | CIS |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Privileged access |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1111 Multi-Factor Authentication Interception |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.2.5 |
| Benchmark level | L2 |
| Benchmark profiles | E3 Level 2 |
| Supports controls | cis-m365:5.2.2.5, nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(8) |
| PowerShell test | Test-MtCisPhishingResistantMfaForAdmin |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
- Test:
tests/cis/Test.CIS.M365.5.2.2.5.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.2.2.5.md