CISA.MS.AAD.3.8 - Managed Devices SHOULD be required to register MFA.

Overview

Managed Devices SHOULD be required to register MFA.

Rationale: Reduce risk of an adversary using stolen user credentials and then registering their own MFA device to access the tenant by requiring a managed device provisioned and controlled by the agency to perform registration actions. This prevents the adversary from using their own unmanaged device to perform the registration.

Remediation action:

Create a conditional access policy requiring a user to be on a managed device when registering for MFA.

1. In Entra under Protection and Conditional Access, select Policies.
2. Click on New policy
3. Under New Conditional Access policy, configure the following policy settings in the new conditional access policy, per the values below:
   • Users > Include > All users
   • Target resources > User actions > Register security information
   • Access controls > Grant > Grant Access > Require device to be marked as compliant and Require Microsoft Entra hybrid joined device > For multiple controls > Require one of the selected controls
4. Click Save.

Related links

• Entra admin center - Conditional Access | Policies
• CISA Strong Authentication & Secure Registration - MS.AAD.3.8v1
• CISA ScubaGear Rego Reference

Test Metadata

Field	Value
Test ID	CISA.MS.AAD.3.8
Severity	High
Suite	CISA
Category	Entra ID P1
PowerShell test	Test-MtCisaManagedDeviceRegistration
Tags	CISA, CISA.MS.AAD.3.8, Entra ID P1, MS.AAD, MS.AAD.3.8

Source

• Pester test: tests/cisa/entra/Test-MtCisaManagedDeviceRegistration.Tests.ps1
• PowerShell source: powershell/public/cisa/entra/Test-MtCisaManagedDeviceRegistration.ps1