# Multi-factor authentication used for authenticating human users of online services is phishing-resistant

Multi-factor authentication used for authenticating human users of online services is phishing-resistant (ISM-1872, Essential Eight Maturity Level Two).

Source: https://maester.dev/docs/tests/ASD.ISM-1872

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jusso-dev" title="jusso-dev · Original author"><img src="https://github.com/jusso-dev.png" alt="jusso-dev" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jusso-dev">jusso-dev</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/asd">ASD</a> · Entra ID · Conditional Access · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId ASD.ISM-1872
```

## Overview

Multi-factor authentication used for authenticating human users of online services is phishing-resistant (ISM-1872, Essential Eight Maturity Level Two).

Push notifications, one-time codes and SMS are relayed by adversary-in-the-middle phishing kits in real time. Passkeys (FIDO2), Windows Hello for Business and certificate-based authentication bind the sign-in to the site, so a proxied page gets nothing it can replay.

ASD's assessment guide applies this requirement to unprivileged and privileged users alike, and the ASD Blueprint for Secure Cloud meets it with one Conditional Access policy for all users and all resources that requires the **Phishing-resistant MFA** authentication strength. This test runs the same check as [CISA.MS.AAD.3.1](https://maester.dev/docs/tests/CISA.MS.AAD.3.1): an enabled policy that targets all users and all resources and requires the built-in **Phishing-resistant MFA** strength, or a custom strength limited to Windows Hello for Business, passkeys (FIDO2) and certificate-based multifactor authentication.

#### Remediation action

1. Register phishing-resistant methods for your users: enable **Passkey (FIDO2)** and **Certificate-based authentication** under **Entra ID** > **[Authentication methods](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods)**, and deploy Windows Hello for Business to managed devices.
2. In **Entra ID** > **[Conditional Access](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies)**, create a policy with **Users** > **All users** (exclude your emergency access accounts), **Target resources** > **All resources**, and **Grant** > **Require authentication strength** > **Phishing-resistant MFA**.
3. Roll it out by group, starting with administrators, before you target all users.

#### Related links

* [Essential Eight maturity model](https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-maturity-model)
* [ASD Blueprint for Secure Cloud: Require strong auth](https://blueprint.asd.gov.au/configuration/entra-id/protection/conditional-access/policies/strong-authentication/)
* [Conditional Access authentication strength](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-strengths)
* [Phishing-resistant passwordless authentication deployment](https://learn.microsoft.com/entra/identity/authentication/how-to-plan-prerequisites-phishing-resistant-passwordless-authentication)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | ASD.ISM-1872 |
| Severity | High |
| Suite | ASD |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | High |
| Implementation cost | High |
| MITRE ATT&CK | T1566.002 Spearphishing Link |
| Supports benchmark | ASD Essential Eight maturity model (version 2026.09.4), requirement ISM-1872 |
| Benchmark level | ML2 |
| Essential Eight strategy | Multi-factor authentication |
| Supports controls | essential-eight:ISM-1872, ism:ISM-1872 |
| PowerShell test | [Test-MtAsdPhishingResistantMfa](https://github.com/maester365/maester/blob/main/tests/asd/entra/Test.ASD.ISM-1872.ps1) |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |

</details>

## Source

- Test: [`tests/asd/entra/Test.ASD.ISM-1872.ps1`](https://github.com/maester365/maester/blob/main/tests/asd/entra/Test.ASD.ISM-1872.ps1)
- Documentation: [`tests/asd/entra/Test.ASD.ISM-1872.md`](https://github.com/maester365/maester/blob/main/tests/asd/entra/Test.ASD.ISM-1872.md)