# (L1) Ensure sign-in frequency for Intune Enrollment is set to 'Every time'

An enabled Conditional Access policy requires MFA every time a user enrols a device in Microsoft Intune.

Source: https://maester.dev/docs/tests/CIS.M365.5.2.2.11

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Entra ID · Conditional Access · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.5.2.2.11
```

## Overview

An enabled Conditional Access policy requires MFA every time a user enrols a device in Microsoft Intune.

Enrolling a device gives it a managed identity that other Conditional Access policies trust. If an attacker enrols a device with a stolen session, that device then satisfies the managed device requirements. Asking for a fresh MFA on every enrolment keeps the enrolment step tied to the real user.

The policy targets the Microsoft Intune Enrollment cloud app, which appears in the app picker once Intune is licensed.

User and group exclusions are not evaluated by this test. Application exclusions are also not evaluated when the policy targets all apps; verify exclusions are documented and reviewed annually. A condition that narrows the policy is reported unless the check is about that condition.

#### Remediation action

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
2. Go to **Entra ID** > **Conditional Access** > [**Policies**](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) and select **New policy**.
3. Under **Users**, include **All users**. Exclude your emergency access accounts.
4. Under **Target resources**, select **Select resources** and add **Microsoft Intune Enrollment**.
5. Under **Grant**, select **Grant access** and **Require multifactor authentication**.
6. Under **Session**, select **Sign-in frequency** and set it to **Every time**.
7. Set **Enable policy** to **On** (use **Report-only** first to measure the impact) and select **Create**.

#### Related links

* [Microsoft Entra admin center - Conditional Access policies](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies)
* [Conditional Access session controls: sign-in frequency](https://learn.microsoft.com/entra/identity/conditional-access/concept-conditional-access-session#sign-in-frequency)
* [Require MFA for device enrollment](https://learn.microsoft.com/intune/intune-service/enrollment/multi-factor-authentication)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.2.11](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.5.2.2.11 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1098.005 Device Registration |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.2.11 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.2.2.11, nist-800-53-r5:IA-11 |
| PowerShell test | [Test-MtCisIntuneEnrollmentSignInFrequency](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.11.ps1) |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.5.2.2.11.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.11.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.5.2.2.11.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.11.md)