Multi-factor authentication used for authenticating human users of online services is phishing-resistant

Contributed by jusso-devAll contributors →

Part of ASD · Entra ID · Conditional Access · All checks

Run this check

Invoke-Maester -TestId ASD.ISM-1872

Overview

Multi-factor authentication used for authenticating human users of online services is phishing-resistant (ISM-1872, Essential Eight Maturity Level Two).

Push notifications, one-time codes and SMS are relayed by adversary-in-the-middle phishing kits in real time. Passkeys (FIDO2), Windows Hello for Business and certificate-based authentication bind the sign-in to the site, so a proxied page gets nothing it can replay.

ASD’s assessment guide applies this requirement to unprivileged and privileged users alike, and the ASD Blueprint for Secure Cloud meets it with one Conditional Access policy for all users and all resources that requires the Phishing-resistant MFA authentication strength. This test runs the same check as CISA.MS.AAD.3.1: an enabled policy that targets all users and all resources and requires the built-in Phishing-resistant MFA strength, or a custom strength limited to Windows Hello for Business, passkeys (FIDO2) and certificate-based multifactor authentication.

Remediation action

1. Register phishing-resistant methods for your users: enable Passkey (FIDO2) and Certificate-based authentication under Entra ID > Authentication methods, and deploy Windows Hello for Business to managed devices.
2. In Entra ID > Conditional Access, create a policy with Users > All users (exclude your emergency access accounts), Target resources > All resources, and Grant > Require authentication strength > Phishing-resistant MFA.
3. Roll it out by group, starting with administrators, before you target all users.

Related links

• Essential Eight maturity model
• ASD Blueprint for Secure Cloud: Require strong auth
• Conditional Access authentication strength
• Phishing-resistant passwordless authentication deployment

Details

Every attribute of this check

Field	Value
Test ID	ASD.ISM-1872
Severity	High
Suite	ASD
Product	Entra ID
Feature	Conditional Access
Area	Authentication
Resource type	Tenant
User impact	High
Implementation cost	High
MITRE ATT&CK	T1566.002 Spearphishing Link
Supports benchmark	ASD Essential Eight maturity model (version 2026.09.4), requirement ISM-1872
Benchmark level	ML2
Essential Eight strategy	Multi-factor authentication
Supports controls	essential-eight:ISM-1872, ism:ISM-1872
PowerShell test	Test-MtAsdPhishingResistantMfa
Services	Graph
Compatible licenses	AAD_PREMIUM

Source

• Test: tests/asd/entra/Test.ASD.ISM-1872.ps1
• Documentation: tests/asd/entra/Test.ASD.ISM-1872.md