# (L1) Ensure a managed device is required for authentication An enabled Conditional Access policy requires a compliant device (or, as an alternative, a hybrid joined device) for all users and all cloud apps. Source: https://maester.dev/docs/tests/CIS.M365.5.2.2.9
jeremy finney
Contributed by jeremy finneyAll contributors →

Part of CIS · Entra ID · Conditional Access · All checks

```powershell title="Run this check" Invoke-Maester -TestId CIS.M365.5.2.2.9 ``` ## Overview An enabled Conditional Access policy requires a compliant device (or, as an alternative, a hybrid joined device) for all users and all cloud apps. A stolen password or session token is far less useful when sign-in is limited to devices that your organisation manages and that meet its security baseline. Unmanaged devices are the usual source of malware that steals tokens. This is a high-impact control: personal and partner devices lose access unless you provide an alternative such as browser-only access with session controls. Enrol devices in Microsoft Intune and define compliance policies before enabling the policy, and use report-only mode first. User and group exclusions are not evaluated by this test. Application exclusions are also not evaluated when the policy targets all apps; verify exclusions are documented and reviewed annually. A condition that narrows the policy is reported unless the check is about that condition. #### Remediation action 1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). 2. Go to **Entra ID** > **Conditional Access** > [**Policies**](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) and select **New policy**. 3. Under **Users**, include **All users**. Exclude your emergency access accounts. 4. Under **Target resources**, select **All resources (formerly All cloud apps)**. 5. Under **Grant**, select **Grant access**, then **Require device to be marked as compliant** and optionally **Require Microsoft Entra hybrid joined device**. Choose **Require one of the selected controls**. 6. Set **Enable policy** to **On** (use **Report-only** first to measure the impact) and select **Create**. #### Related links * [Microsoft Entra admin center - Conditional Access policies](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) * [Require compliant or hybrid joined devices with Conditional Access](https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-device-compliance) * [Require a compliant device in Conditional Access](https://learn.microsoft.com/intune/intune-service/protect/create-conditional-access-intune) * [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.2.9](https://www.cisecurity.org/benchmark/microsoft_365) ## Details
Every attribute of this check | Field | Value | | --- | --- | | Test ID | CIS.M365.5.2.2.9 | | Severity | Medium | | Suite | CIS | | Product | Entra ID | | Feature | Conditional Access | | Area | Access control | | Resource type | Tenant | | User impact | High | | Implementation cost | High | | MITRE ATT&CK | T1078.004 Cloud Accounts | | Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.2.9 | | Benchmark level | L1 | | Benchmark profiles | E3 Level 1 | | Supports controls | cis-m365:5.2.2.9, nist-800-53-r5:IA-3 | | PowerShell test | [Test-MtCisManagedDeviceForAuthentication](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.9.ps1) | | Services | Graph | | Compatible licenses | AAD_PREMIUM |
## Source - Test: [`tests/cis/Test.CIS.M365.5.2.2.9.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.9.ps1) - Documentation: [`tests/cis/Test.CIS.M365.5.2.2.9.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.9.md)