# (L1) Ensure multifactor authentication is enabled for all users in administrative roles An enabled Conditional Access policy requires multifactor authentication for the privileged directory roles, in all cloud apps. Source: https://maester.dev/docs/tests/CIS.M365.5.2.2.1
jeremy finney
Contributed by jeremy finneyAll contributors →

Part of CIS · Entra ID · Conditional Access · All checks

```powershell title="Run this check" Invoke-Maester -TestId CIS.M365.5.2.2.1 ``` ## Overview An enabled Conditional Access policy requires multifactor authentication for the privileged directory roles, in all cloud apps. Administrator accounts can change identity, mail and security configuration for the whole organisation. A password alone is enough for an attacker who phished or sprayed it. Requiring MFA at sign-in for these roles makes a stolen password insufficient. The test passes when one enabled policy lists every role in the set that the test checks: Application, Authentication, Billing, Cloud Application, Conditional Access, Exchange, Global, Helpdesk, Password, Privileged Authentication, Privileged Role, Security, SharePoint and User Administrator roles, plus Global Reader. Policies in report-only mode do not count. Keep emergency access accounts in the policy exclusions. User and group exclusions are not evaluated by this test. Application exclusions are also not evaluated when the policy targets all apps; verify exclusions are documented and reviewed annually. A condition that narrows the policy is reported unless the check is about that condition. #### Remediation action 1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). 2. Go to **Entra ID** > **Conditional Access** > [**Policies**](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) and select **New policy**. 3. Under **Users**, select **Include** > **Select users and groups** > **Directory roles** and add every role listed above. Exclude your emergency access accounts. 4. Under **Target resources**, select **All resources (formerly All cloud apps)**. 5. Under **Grant**, select **Grant access** and **Require multifactor authentication** (or **Require authentication strength**). 6. Set **Enable policy** to **On** (use **Report-only** first to measure the impact) and select **Create**. #### Related links * [Microsoft Entra admin center - Conditional Access policies](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) * [Require multifactor authentication for administrators with Conditional Access](https://learn.microsoft.com/entra/identity/conditional-access/howto-conditional-access-policy-admin-mfa) * [Plan a Conditional Access deployment](https://learn.microsoft.com/entra/identity/conditional-access/plan-conditional-access) * [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.2.1](https://www.cisecurity.org/benchmark/microsoft_365) ## Details
Every attribute of this check | Field | Value | | --- | --- | | Test ID | CIS.M365.5.2.2.1 | | Severity | High | | Suite | CIS | | Product | Entra ID | | Feature | Conditional Access | | Area | Privileged access | | Resource type | Tenant | | User impact | Low | | Implementation cost | Low | | MITRE ATT&CK | T1078.004 Cloud Accounts, T1110.003 Password Spraying | | Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.2.1 | | Benchmark level | L1 | | Benchmark profiles | E3 Level 1 | | Supports controls | cis-m365:5.2.2.1, nist-800-53-r5:IA-2(1) | | PowerShell test | [Test-MtCisMfaForAdminRole](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.1.ps1) | | Services | Graph | | Compatible licenses | AAD_PREMIUM |
## Source - Test: [`tests/cis/Test.CIS.M365.5.2.2.1.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.1.ps1) - Documentation: [`tests/cis/Test.CIS.M365.5.2.2.1.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.1.md)