# Device registration MFA control conflicts with Conditional Access policies

When MFA is required during device registration in Conditional Access policies, it must be disabled in the Entra ID Device settings.

Source: https://maester.dev/docs/tests/MT.1061

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/robbevandendaele" title="Robbe Van den Daele · Original author"><img src="https://github.com/RobbeVandenDaele.png" alt="Robbe Van den Daele" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/thomas-s-schmidt" title="Thomas Schmidt · Co-contributor"><img src="https://github.com/thomas-s-schmidt.png" alt="Thomas Schmidt" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/robbevandendaele">Robbe Van den Daele</a> with <a href="/contributors/thomas-s-schmidt">Thomas Schmidt</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Entra ID · Conditional Access · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1061
```

## Overview

When MFA is required during device registration in Conditional Access policies, it must be disabled in the Entra ID Device settings.

When both are enabled, the Conditional Access policy with the "Register or join devices" user action will not work as expected.

#### Remediation action

When a Conditional Access policy is configured with the **Register or join devices user action** you must disable tenant-wide multifactor requirement for device registration. Otherwise, Conditional Access policies with this user action are not properly enforced.

1. Open **[Entra - Device Settings](https://entra.microsoft.com/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/DeviceSettings/menuId/Devices)**.
2. Set **Require Multifactor Authentication to register or join devices with Microsoft Entra** to **No**.

#### Related links

- [Require multifactor authentication for device registration](https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-device-registration#create-a-conditional-access-policy)
- [Conflicting Conditional Access policies and Entra Device Settings](https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-device-registration#create-a-conditional-access-policy:~:text=When%20a%20Conditional%20Access%20policy%20is%20configured%20with%20the%20Register%20or%20join%20devices%20user%20action)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1061 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | ConditionalAccessPolicy |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1098.005 Device Registration |
| PowerShell test | [Test-MtDeviceRegistrationMfaConflict](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1061.ps1) |
| Services | Graph |

</details>

## Source

- Test: [`tests/maester/entra/Test.MT.1061.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1061.ps1)
- Documentation: [`tests/maester/entra/Test.MT.1061.md`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1061.md)