# Multi-factor authentication is used to authenticate human users to their organisation's online services

Multi-factor authentication is used to authenticate human users to their organisation's online services that process, store or communicate their…

Source: https://maester.dev/docs/tests/ASD.ISM-1504

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jusso-dev" title="jusso-dev · Original author"><img src="https://github.com/jusso-dev.png" alt="jusso-dev" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jusso-dev">jusso-dev</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/asd">ASD</a> · Entra ID · Conditional Access · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId ASD.ISM-1504
```

## Overview

Multi-factor authentication is used to authenticate human users to their organisation's online services that process, store or communicate their organisation's sensitive data (ISM-1504, Essential Eight Maturity Level One).

A password alone is defeated by phishing, password spray and credential stuffing. Requiring a second factor for every user on every resource is the first Essential Eight requirement for multi-factor authentication, and the baseline the phishing-resistant requirement of Maturity Level Two builds on.

ASD defines which factors count, not how the policy is built, so this test runs the same check as [CIS.M365.5.2.2.2](https://maester.dev/docs/tests/CIS.M365.5.2.2.2). It looks for an enabled Conditional Access policy that targets all users and all resources and requires multi-factor authentication or an authentication strength. Policies that apply only at a certain risk level, exclude applications or are narrowed by a condition such as a platform or location do not count. Excluding emergency access accounts is expected.

#### Remediation action

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
2. Go to **Entra ID** > **Conditional Access** > [**Policies**](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) and select **New policy**.
3. Under **Users**, include **All users**. Exclude your emergency access accounts.
4. Under **Target resources**, select **All resources (formerly All cloud apps)**.
5. Under **Grant**, select **Grant access** and **Require multifactor authentication** (or **Require authentication strength**).
6. Set **Enable policy** to **On** (use **Report-only** first to measure the impact) and select **Create**.

#### Related links

* [Essential Eight maturity model](https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-maturity-model)
* [Essential Eight assessment process guide](https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-assessment-process-guide)
* [Require multifactor authentication for all users with Conditional Access](https://learn.microsoft.com/entra/identity/conditional-access/howto-conditional-access-policy-all-users-mfa)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | ASD.ISM-1504 |
| Severity | High |
| Suite | ASD |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1110 Brute Force |
| Supports benchmark | ASD Essential Eight maturity model (version 2026.09.4), requirement ISM-1504 |
| Benchmark level | ML1 |
| Essential Eight strategy | Multi-factor authentication |
| Supports controls | essential-eight:ISM-1504, nist-800-53-r5:IA-2(2), ism:ISM-1504 |
| PowerShell test | [Test-MtAsdMfaAllUsers](https://github.com/maester365/maester/blob/main/tests/asd/entra/Test.ASD.ISM-1504.ps1) |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |

</details>

## Source

- Test: [`tests/asd/entra/Test.ASD.ISM-1504.ps1`](https://github.com/maester365/maester/blob/main/tests/asd/entra/Test.ASD.ISM-1504.ps1)
- Documentation: [`tests/asd/entra/Test.ASD.ISM-1504.md`](https://github.com/maester365/maester/blob/main/tests/asd/entra/Test.ASD.ISM-1504.md)