Multi-factor authentication is used to authenticate human users to their organisation's online services

Contributed by jusso-devAll contributors →

Part of ASD · Entra ID · Conditional Access · All checks

Run this check

Invoke-Maester -TestId ASD.ISM-1504

Overview

Multi-factor authentication is used to authenticate human users to their organisation’s online services that process, store or communicate their organisation’s sensitive data (ISM-1504, Essential Eight Maturity Level One).

A password alone is defeated by phishing, password spray and credential stuffing. Requiring a second factor for every user on every resource is the first Essential Eight requirement for multi-factor authentication, and the baseline the phishing-resistant requirement of Maturity Level Two builds on.

ASD defines which factors count, not how the policy is built, so this test runs the same check as CIS.M365.5.2.2.2. It looks for an enabled Conditional Access policy that targets all users and all resources and requires multi-factor authentication or an authentication strength. Policies that apply only at a certain risk level, exclude applications or are narrowed by a condition such as a platform or location do not count. Excluding emergency access accounts is expected.

Remediation action

1. Sign in to the Microsoft Entra admin center.
2. Go to Entra ID > Conditional Access > Policies and select New policy.
3. Under Users, include All users. Exclude your emergency access accounts.
4. Under Target resources, select All resources (formerly All cloud apps).
5. Under Grant, select Grant access and Require multifactor authentication (or Require authentication strength).
6. Set Enable policy to On (use Report-only first to measure the impact) and select Create.

Related links

• Essential Eight maturity model
• Essential Eight assessment process guide
• Require multifactor authentication for all users with Conditional Access

Details

Every attribute of this check

Field	Value
Test ID	ASD.ISM-1504
Severity	High
Suite	ASD
Product	Entra ID
Feature	Conditional Access
Area	Authentication
Resource type	Tenant
User impact	Medium
Implementation cost	Medium
MITRE ATT&CK	T1078.004 Cloud Accounts, T1110 Brute Force
Supports benchmark	ASD Essential Eight maturity model (version 2026.09.4), requirement ISM-1504
Benchmark level	ML1
Essential Eight strategy	Multi-factor authentication
Supports controls	essential-eight:ISM-1504, nist-800-53-r5:IA-2(2), ism:ISM-1504
PowerShell test	Test-MtAsdMfaAllUsers
Services	Graph
Compatible licenses	AAD_PREMIUM

Source

• Test: tests/asd/entra/Test.ASD.ISM-1504.ps1
• Documentation: tests/asd/entra/Test.ASD.ISM-1504.md