Microsoft Entra ID must be configured to use multifactor authentication (MFA)

Contributed by Merill FernandoAll contributors →

Part of DISA · Entra ID · Conditional Access · All checks

Run this check

Invoke-Maester -TestId DISA.V-270233

Overview

An enabled Conditional Access policy requires multifactor authentication for all users. (DISA Microsoft Entra ID STIG, V-270233, CAT I).

A password alone is stolen by phishing, spray or reuse every day. Multifactor authentication for every user is the main control against those attacks, which is why DISA rates this rule CAT I.

DISA’s check looks for an enabled Conditional Access policy that includes all users and requires MFA, with every exclusion documented with the authorizing official. This test runs CIS.M365.5.2.2.2, which checks that policy. Documenting the exclusions is up to you.

Remediation action

1. In the Microsoft Entra admin center, go to Entra ID > Conditional Access > Policies.
2. Create a policy (or use the Require multifactor authentication for all users template) that includes All users and All resources and grants access only with Require multifactor authentication or an authentication strength.
3. Exclude only your emergency access accounts, and document each exclusion with your authorizing official.
4. Set Enable policy to On and select Save.

Related links

• DISA Microsoft Entra ID STIG: V-270233
• Require multifactor authentication for all users

Details

Every attribute of this check

Field	Value
Test ID	DISA.V-270233
Severity	High
Suite	DISA
Product	Entra ID
Feature	Conditional Access
Area	Authentication
Resource type	Tenant
User impact	Medium
Implementation cost	Medium
MITRE ATT&CK	T1078.004 Cloud Accounts, T1110 Brute Force
Supports benchmark	DISA Microsoft Entra ID STIG (version V1R2), requirement V-270233
Supports controls	disa-stig-entra-id:V-270233, nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2)
PowerShell test	Test-MtDisaEntraMfa
Services	Graph
Compatible licenses	AAD_PREMIUM

Source

• Test: tests/disa/Test.DISA.V-270233.ps1
• Documentation: tests/disa/Test.DISA.V-270233.md