# Microsoft Entra ID must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the application

The Microsoft Entra sign-in page shows the Standard Mandatory DoD Notice and Consent Banner (DISA Microsoft Entra ID STIG, V-270209, CAT II).

Source: https://maester.dev/docs/tests/DISA.V-270209

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/merill" title="Merill Fernando · Original author"><img src="https://github.com/merill.png" alt="Merill Fernando" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/merill">Merill Fernando</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/disa">DISA</a> · Entra ID · User and directory settings · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId DISA.V-270209 -IncludePreview
```

## Overview

The Microsoft Entra sign-in page shows the Standard Mandatory DoD Notice and Consent Banner (DISA Microsoft Entra ID STIG, V-270209, CAT II).

DoD information systems must tell every user, before they sign in, that the system is a U.S. Government system, that use is monitored, and that they consent to the terms. In Microsoft Entra ID the banner goes in the **Sign-in page text** of the default company branding, which appears on the sign-in page of every Microsoft cloud app.

The check reads the sign-in page text and passes when it contains the banner: by default the opening sentence of the full banner, or the short banner ("I've read & consent to terms in IS user agreem't.") that DoD allows where space is limited. The field holds 1,024 characters at most, so the full banner may not fit. To look for a different text, set `RequiredText`.

The banner is a DoD requirement. Outside DoD this test fails by design; leave it out of your runs.

#### Remediation action

1. In the [Microsoft Entra admin center](https://entra.microsoft.com), go to **Entra ID** > **Custom branding** > **[Company branding](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/CompanyBrandingMenuBlade/~/CompanyBranding)**.
2. Edit the **Default sign-in experience** (or select **Customize** if there is none yet).
3. On the **Sign-in form** tab, enter the DoD Notice and Consent Banner in **Sign-in page text**.
4. Select **Review + save**, then **Save**.

#### Related links

* [DISA Microsoft Entra ID STIG: V-270209](https://cyber.trackr.live/stig/Entra_ID/1/2/V-270209)
* [Add company branding to your organization's sign-in page](https://learn.microsoft.com/entra/fundamentals/how-to-customize-branding)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | DISA.V-270209 |
| Severity | Low |
| Suite | DISA |
| Product | Entra ID |
| Feature | User and directory settings |
| Area | Access control |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | None |
| Supports benchmark | DISA Microsoft Entra ID STIG (version V1R2), requirement V-270209 |
| Supports controls | disa-stig-entra-id:V-270209, nist-800-53-r5:AC-8 |
| PowerShell test | [Test-MtDisaSignInBanner](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-270209.ps1) |
| Services | Graph |
| Lifecycle | Preview |

</details>

## Source

- Test: [`tests/disa/Test.DISA.V-270209.ps1`](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-270209.ps1)
- Documentation: [`tests/disa/Test.DISA.V-270209.md`](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-270209.md)