# (L2) Ensure 'Phishing-resistant MFA strength' is required for Administrators

An enabled Conditional Access policy requires the phishing-resistant MFA authentication strength for the administrative roles.

Source: https://maester.dev/docs/tests/CIS.M365.5.2.2.5

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Entra ID · Conditional Access · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.5.2.2.5
```

## Overview

An enabled Conditional Access policy requires the phishing-resistant MFA authentication strength for the administrative roles.

Push notifications, SMS and one-time codes can be relayed by an adversary-in-the-middle phishing site. Phishing-resistant methods bind the sign-in to the real site, so a relayed prompt does not work. Administrators are the highest-value targets, so they are the first accounts to move to these methods.

Users need a registered FIDO2 security key, Windows Hello for Business or a certificate before the policy is enabled for them, otherwise they are locked out. Roll out in report-only mode and keep emergency access accounts excluded.

The allowed combinations must be a non-empty subset of Windows Hello for Business, FIDO2 or certificate-based multifactor authentication. It does not need to include all three, and any other method makes the check fail.

Policies with sign-in-risk or user-risk conditions are not evaluated by this test, so narrowing conditions on those policies are not reported. User and group exclusions are not evaluated by this test. Application exclusions are also not evaluated when the policy targets all apps; verify exclusions are documented and reviewed annually. For policies this test evaluates, a condition that narrows the policy is reported unless the check is about that condition.

#### Remediation action

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
2. Go to **Entra ID** > **Conditional Access** > [**Policies**](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) and select **New policy**.
3. Under **Users**, select **Directory roles** and add the administrative roles. Exclude your emergency access accounts.
4. Under **Target resources**, select **All resources (formerly All cloud apps)**.
5. Under **Grant**, select **Grant access** and **Require authentication strength**, then choose **Phishing-resistant MFA**.
6. Set **Enable policy** to **On** (use **Report-only** first to measure the impact) and select **Create**.

#### Related links

* [Microsoft Entra admin center - Conditional Access policies](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies)
* [Require phishing-resistant multifactor authentication for administrators](https://learn.microsoft.com/entra/identity/conditional-access/policy-admin-phish-resistant-mfa)
* [Conditional Access authentication strength](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-strengths)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.2.5](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.5.2.2.5 |
| Severity | High |
| Suite | CIS |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Privileged access |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1111 Multi-Factor Authentication Interception |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.2.5 |
| Benchmark level | L2 |
| Benchmark profiles | E3 Level 2 |
| Supports controls | cis-m365:5.2.2.5, nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(8) |
| PowerShell test | [Test-MtCisPhishingResistantMfaForAdmin](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.5.ps1) |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.5.2.2.5.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.5.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.5.2.2.5.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.5.md)