CIS.M365.5.2.3.6 - (L1) Ensure system-preferred multifactor authentication is enabled
Overview
System-preferred multifactor authentication is enabled and applies to all users.
With the feature on, Microsoft Entra ID prompts for the most secure method the user has registered and that is allowed, rather than the method the user picked last or a weaker default. Users who registered both an authenticator app and SMS are asked to use the app, which resists interception and phishing better.
Users can still choose another method from the prompt. The setting only changes which method is offered first.
Remediation action
- Sign in to the Microsoft Entra admin center.
- Go to Entra ID > Authentication methods > Settings.
- Set System-preferred multifactor authentication to Enabled.
- Set the target to All users.
- Select Save.
Related links
- Microsoft Entra admin center - Authentication methods policies
- System-preferred multifactor authentication
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.3.6
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.2.3.6 |
| Severity | Low |
| Suite | CIS |
| Product | Entra ID |
| Feature | Authentication methods |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1111 Multi-Factor Authentication Interception |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.3.6 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.2.3.6, nist-800-53-r5:IA-2 |
| PowerShell test | Test-MtCisSystemPreferredMfa |
| Services | Graph |
Source
- Test:
tests/cis/Test.CIS.M365.5.2.3.6.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.2.3.6.md