# Microsoft Intune service must be configured to use multifactor authentication for network access to privileged and nonprivileged accounts

An enabled Conditional Access policy requires multifactor authentication for all users, including everyone who signs in to Intune.

Source: https://maester.dev/docs/tests/DISA.V-267341

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/merill" title="Merill Fernando · Original author"><img src="https://github.com/merill.png" alt="Merill Fernando" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/merill">Merill Fernando</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/disa">DISA</a> · Entra ID · Conditional Access · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId DISA.V-267341
```

## Overview

An enabled Conditional Access policy requires multifactor authentication for all users, including everyone who signs in to Intune. (DISA Microsoft Intune MDM Service Desktop STIG, V-267341, CAT II).

Intune sign-ins are handled by Microsoft Entra ID, so multifactor authentication for Intune users is a Conditional Access policy for all users.

This test runs [CIS.M365.5.2.2.2](https://maester.dev/docs/tests/CIS.M365.5.2.2.2), which checks for an enabled Conditional Access policy that requires MFA for all users.

#### Remediation action

1. In the [Microsoft Entra admin center](https://entra.microsoft.com), go to **Entra ID** > **Conditional Access** > **[Policies](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies)**.
2. Create a policy (or use the **Require multifactor authentication for all users** template) that includes **All users** and **All resources** and grants access only with **Require multifactor authentication** or an authentication strength.
3. Exclude only your emergency access accounts, and document each exclusion with your authorizing official.
4. Set **Enable policy** to **On** and select **Save**.

#### Related links

* [DISA Microsoft Intune MDM Service Desktop STIG: V-267341](https://cyber.trackr.live/stig/Intune_Service_Desktop/1/1/V-267341)
* [Require multifactor authentication for all users](https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-mfa-strength)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | DISA.V-267341 |
| Severity | High |
| Suite | DISA |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1110 Brute Force |
| Supports benchmark | DISA Microsoft Intune MDM Service Desktop STIG (version V1R1), requirement V-267341 |
| Supports controls | disa-stig-intune-desktop:V-267341, nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2) |
| PowerShell test | [Test-MtDisaIntuneDesktopMfa](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-267341.ps1) |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |

</details>

## Source

- Test: [`tests/disa/Test.DISA.V-267341.ps1`](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-267341.ps1)
- Documentation: [`tests/disa/Test.DISA.V-267341.md`](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-267341.md)