Skip to main content
Version: 2.1.0

CISA.MS.AAD.3.2 - If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users.

Overview​

If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users.

Rationale: This is a stopgap security policy to help protect the tenant if phishing-resistant MFA has not been enforced. This policy requires MFA enforcement, thus reducing single-form authentication risk.

Remediation action:​

If phishing-resistant MFA has not been enforced for all users yet, create a conditional access policy that enforces MFA but does not dictate MFA method. Configure the following policy settings in the new conditional access policy, per the values below:

  • Users > Include > All users
  • Target resources > Cloud apps > All cloud apps
  • Access controls > Grant > Grant Access > Require multifactor authentication

Test Metadata​

FieldValue
Test IDCISA.MS.AAD.3.2
SeverityHigh
SuiteCISA
CategoryEntra ID P1
PowerShell testTest-MtCisaMfa
TagsCISA, CISA.MS.AAD.3.2, Entra ID P1, MS.AAD, MS.AAD.3.2

Source​

  • Pester test: tests/cisa/entra/Test-MtCisaMfa.Tests.ps1
  • PowerShell source: powershell/public/cisa/entra/Test-MtCisaMfa.ps1