CIS.M365.5.2.2.9 - (L1) Ensure a managed device is required for authentication
Overview
An enabled Conditional Access policy requires a compliant device (or, as an alternative, a hybrid joined device) for all users and all cloud apps.
A stolen password or session token is far less useful when sign-in is limited to devices that your organisation manages and that meet its security baseline. Unmanaged devices are the usual source of malware that steals tokens.
This is a high-impact control: personal and partner devices lose access unless you provide an alternative such as browser-only access with session controls. Enrol devices in Microsoft Intune and define compliance policies before enabling the policy, and use report-only mode first.
User and group exclusions are not evaluated by this test. Application exclusions are also not evaluated when the policy targets all apps; verify exclusions are documented and reviewed annually. A condition that narrows the policy is reported unless the check is about that condition.
Remediation action
- Sign in to the Microsoft Entra admin center.
- Go to Entra ID > Conditional Access > Policies and select New policy.
- Under Users, include All users. Exclude your emergency access accounts.
- Under Target resources, select All resources (formerly All cloud apps).
- Under Grant, select Grant access, then Require device to be marked as compliant and optionally Require Microsoft Entra hybrid joined device. Choose Require one of the selected controls.
- Set Enable policy to On (use Report-only first to measure the impact) and select Create.
Related links
- Microsoft Entra admin center - Conditional Access policies
- Require compliant or hybrid joined devices with Conditional Access
- Require a compliant device in Conditional Access
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.2.9
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.2.2.9 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Access control |
| Resource type | Tenant |
| User impact | High |
| Implementation cost | High |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.2.9 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.2.2.9, nist-800-53-r5:IA-3 |
| PowerShell test | Test-MtCisManagedDeviceForAuthentication |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
- Test:
tests/cis/Test.CIS.M365.5.2.2.9.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.2.2.9.md