# Phishing-resistant MFA SHALL be enforced for all users

Phishing-resistant MFA SHALL be enforced for all users. A Maester check for Entra ID, Conditional Access.

Source: https://maester.dev/docs/tests/CISA.MS.AAD.3.1

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cisa">CISA</a> · Entra ID · Conditional Access · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CISA.MS.AAD.3.1
```

## Overview

Phishing-resistant MFA SHALL be enforced for all users.

Rationale: Weaker forms of MFA do not protect against sophisticated phishing attacks. By enforcing methods resistant to phishing, those risks are minimized.

The test passes when an enabled Conditional Access policy for all users and all cloud apps requires the built-in **Phishing-resistant MFA** authentication strength, or a custom authentication strength limited to Windows Hello for Business, passkeys (FIDO2) and certificate-based multifactor authentication.

#### Remediation action:

Create a Conditional Access policy enforcing phishing-resistant MFA for all users. Configure the following policy settings in the new Conditional Access policy, per the values below:

* Users > Include > **All users**
* Target resources > Cloud apps > **All cloud apps**
* Access controls > Grant > Grant Access > Require authentication strength > **Phishing-resistant MFA**

#### Related links

* [CISA Strong Authentication & Secure Registration - MS.AAD.3.1v1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md#msaad31v1)
* [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/AADConfig.rego#L181)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CISA.MS.AAD.3.1 |
| Severity | High |
| Suite | CISA |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | High |
| Implementation cost | High |
| MITRE ATT&CK | T1566.002 Spearphishing Link |
| Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.3.1 |
| Criticality | SHALL |
| Upstream requirement | MS.AAD.3.1v1 |
| Supports controls | cisa-scuba:MS.AAD.3.1, nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2), nist-800-53-r5:IA-5c, nist-800-53-r5:IA-5g, nist-800-53-r5:IA-2(8) |
| PowerShell test | [Test-MtCisaPhishResistant](https://github.com/maester365/maester/blob/main/tests/cisa/entra/Test.CISA.MS.AAD.3.1.ps1) |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |

</details>

## Source

- Test: [`tests/cisa/entra/Test.CISA.MS.AAD.3.1.ps1`](https://github.com/maester365/maester/blob/main/tests/cisa/entra/Test.CISA.MS.AAD.3.1.ps1)
- Documentation: [`tests/cisa/entra/Test.CISA.MS.AAD.3.1.md`](https://github.com/maester365/maester/blob/main/tests/cisa/entra/Test.CISA.MS.AAD.3.1.md)