(L1) Ensure system-preferred multifactor authentication is enabled

Contributed by jeremy finneyAll contributors →

Part of CIS · Entra ID · Authentication methods · All checks

Run this check

Invoke-Maester -TestId CIS.M365.5.2.3.6

Overview

System-preferred multifactor authentication is enabled and applies to all users.

With the feature on, Microsoft Entra ID prompts for the most secure method the user has registered and that is allowed, rather than the method the user picked last or a weaker default. Users who registered both an authenticator app and SMS are asked to use the app, which resists interception and phishing better.

Users can still choose another method from the prompt. The setting only changes which method is offered first.

Remediation action

1. Sign in to the Microsoft Entra admin center.
2. Go to Entra ID > Authentication methods > Settings.
3. Set System-preferred multifactor authentication to Enabled.
4. Set the target to All users.
5. Select Save.

Related links

• Microsoft Entra admin center - Authentication methods policies
• System-preferred multifactor authentication
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.3.6

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.5.2.3.6
Severity	Low
Suite	CIS
Product	Entra ID
Feature	Authentication methods
Area	Authentication
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1111 Multi-Factor Authentication Interception
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.3.6
Benchmark level	L1
Benchmark profiles	E3 Level 1
Supports controls	cis-m365:5.2.3.6, nist-800-53-r5:IA-2
PowerShell test	Test-MtCisSystemPreferredMfa
Services	Graph

Source

• Test: tests/cis/Test.CIS.M365.5.2.3.6.ps1
• Documentation: tests/cis/Test.CIS.M365.5.2.3.6.md