# (L1) Ensure system-preferred multifactor authentication is enabled

System-preferred multifactor authentication is enabled and applies to all users.

Source: https://maester.dev/docs/tests/CIS.M365.5.2.3.6

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Entra ID · Authentication methods · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.5.2.3.6
```

## Overview

System-preferred multifactor authentication is enabled and applies to all users.

With the feature on, Microsoft Entra ID prompts for the most secure method the user has registered and that is allowed, rather than the method the user picked last or a weaker default. Users who registered both an authenticator app and SMS are asked to use the app, which resists interception and phishing better.

Users can still choose another method from the prompt. The setting only changes which method is offered first.

#### Remediation action

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
2. Go to **Entra ID** > **Authentication methods** > [**Settings**](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods).
3. Set **System-preferred multifactor authentication** to **Enabled**.
4. Set the target to **All users**.
5. Select **Save**.

#### Related links

* [Microsoft Entra admin center - Authentication methods policies](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods)
* [System-preferred multifactor authentication](https://learn.microsoft.com/entra/identity/authentication/concept-system-preferred-multifactor-authentication)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.3.6](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.5.2.3.6 |
| Severity | Low |
| Suite | CIS |
| Product | Entra ID |
| Feature | Authentication methods |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1111 Multi-Factor Authentication Interception |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.3.6 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.2.3.6, nist-800-53-r5:IA-2 |
| PowerShell test | [Test-MtCisSystemPreferredMfa](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.3.6.ps1) |
| Services | Graph |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.5.2.3.6.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.3.6.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.5.2.3.6.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.3.6.md)