CIS.M365.5.2.3.4 - (L1) Ensure all member users are 'MFA capable'
Overview
Every member user has registered at least one authentication method that can satisfy multifactor authentication.
A Conditional Access policy that requires MFA only helps if users can complete it. A user who has not registered a usable method is either locked out when the policy is enforced or is excluded from it, and in both cases the account is protected by a password alone.
The test reads the registration report, which can lag behind recent changes by a short time. Accounts that are not used for interactive sign-in should be reviewed and, if no longer needed, disabled or removed.
Remediation action
- Sign in to the Microsoft Entra admin center.
- Go to Entra ID > Authentication methods > User registration details.
- Filter on Is MFA capable = No and User type = Member.
- Ask each listed user to register a method at https://aka.ms/mysecurityinfo, or enable a registration campaign or a Conditional Access policy for the security information registration user action.
- Disable or delete accounts that are no longer in use.
Related links
- Microsoft Entra admin center - User registration details
- Authentication methods activity
- Nudge users to set up Microsoft Authenticator
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.3.4
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.2.3.4 |
| Severity | High |
| Suite | CIS |
| Product | Entra ID |
| Feature | Authentication methods |
| Area | Authentication |
| Resource type | User |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1110.003 Password Spraying |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.3.4 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.2.3.4, nist-800-53-r5:IA-2 |
| PowerShell test | Test-MtCisAllMembersMfaCapable |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
- Test:
tests/cis/Test.CIS.M365.5.2.3.4.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.2.3.4.md