Microsoft Intune service must be configured to use multifactor authentication for network access to privileged and nonprivileged accounts

Contributed by Merill FernandoAll contributors →

Part of DISA · Entra ID · Conditional Access · All checks

Run this check

Invoke-Maester -TestId DISA.V-267341

Overview

An enabled Conditional Access policy requires multifactor authentication for all users, including everyone who signs in to Intune. (DISA Microsoft Intune MDM Service Desktop STIG, V-267341, CAT II).

Intune sign-ins are handled by Microsoft Entra ID, so multifactor authentication for Intune users is a Conditional Access policy for all users.

This test runs CIS.M365.5.2.2.2, which checks for an enabled Conditional Access policy that requires MFA for all users.

Remediation action

1. In the Microsoft Entra admin center, go to Entra ID > Conditional Access > Policies.
2. Create a policy (or use the Require multifactor authentication for all users template) that includes All users and All resources and grants access only with Require multifactor authentication or an authentication strength.
3. Exclude only your emergency access accounts, and document each exclusion with your authorizing official.
4. Set Enable policy to On and select Save.

Related links

• DISA Microsoft Intune MDM Service Desktop STIG: V-267341
• Require multifactor authentication for all users

Details

Every attribute of this check

Field	Value
Test ID	DISA.V-267341
Severity	High
Suite	DISA
Product	Entra ID
Feature	Conditional Access
Area	Authentication
Resource type	Tenant
User impact	Medium
Implementation cost	Medium
MITRE ATT&CK	T1078.004 Cloud Accounts, T1110 Brute Force
Supports benchmark	DISA Microsoft Intune MDM Service Desktop STIG (version V1R1), requirement V-267341
Supports controls	disa-stig-intune-desktop:V-267341, nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2)
PowerShell test	Test-MtDisaIntuneDesktopMfa
Services	Graph
Compatible licenses	AAD_PREMIUM

Source

• Test: tests/disa/Test.DISA.V-267341.ps1
• Documentation: tests/disa/Test.DISA.V-267341.md