# Microsoft Entra ID must be configured to use multifactor authentication (MFA)

An enabled Conditional Access policy requires multifactor authentication for all users. (DISA Microsoft Entra ID STIG, V-270233, CAT I).

Source: https://maester.dev/docs/tests/DISA.V-270233

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/merill" title="Merill Fernando · Original author"><img src="https://github.com/merill.png" alt="Merill Fernando" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/merill">Merill Fernando</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/disa">DISA</a> · Entra ID · Conditional Access · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId DISA.V-270233
```

## Overview

An enabled Conditional Access policy requires multifactor authentication for all users. (DISA Microsoft Entra ID STIG, V-270233, CAT I).

A password alone is stolen by phishing, spray or reuse every day. Multifactor authentication for every user is the main control against those attacks, which is why DISA rates this rule CAT I.

DISA's check looks for an enabled Conditional Access policy that includes all users and requires MFA, with every exclusion documented with the authorizing official. This test runs [CIS.M365.5.2.2.2](https://maester.dev/docs/tests/CIS.M365.5.2.2.2), which checks that policy. Documenting the exclusions is up to you.

#### Remediation action

1. In the [Microsoft Entra admin center](https://entra.microsoft.com), go to **Entra ID** > **Conditional Access** > **[Policies](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies)**.
2. Create a policy (or use the **Require multifactor authentication for all users** template) that includes **All users** and **All resources** and grants access only with **Require multifactor authentication** or an authentication strength.
3. Exclude only your emergency access accounts, and document each exclusion with your authorizing official.
4. Set **Enable policy** to **On** and select **Save**.

#### Related links

* [DISA Microsoft Entra ID STIG: V-270233](https://cyber.trackr.live/stig/Entra_ID/1/2/V-270233)
* [Require multifactor authentication for all users](https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-mfa-strength)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | DISA.V-270233 |
| Severity | High |
| Suite | DISA |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1110 Brute Force |
| Supports benchmark | DISA Microsoft Entra ID STIG (version V1R2), requirement V-270233 |
| Supports controls | disa-stig-entra-id:V-270233, nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2) |
| PowerShell test | [Test-MtDisaEntraMfa](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-270233.ps1) |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |

</details>

## Source

- Test: [`tests/disa/Test.DISA.V-270233.ps1`](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-270233.ps1)
- Documentation: [`tests/disa/Test.DISA.V-270233.md`](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-270233.md)