Privileged Microsoft Entra built-in roles are targeted with Conditional Access policies to enforce phishing-resistant methods

Maester checks this too

CIS.M365.5.2.2.5 (Ensure ‘Phishing-resistant MFA strength’ is required for Administrators), CISA.MS.AAD.3.6 (Phishing-resistant MFA SHALL be required for highly privileged roles.) check the same setting. Running both reports it twice.

Overview

Without phishing-resistant authentication methods, privileged users are more vulnerable to phishing attacks. These types of attacks trick users into revealing their credentials to grant unauthorized access to attackers. If non-phishing-resistant authentication methods are used, attackers might intercept credentials and tokens, through methods like adversary-in-the-middle attacks, undermining the security of the privileged account.

Once a privileged account or session is compromised due to weak authentication methods, attackers might manipulate the account to maintain long-term access, create other backdoors, or modify user permissions. Attackers can also use the compromised privileged account to escalate their access even further, potentially gaining control over more sensitive systems.

Remediation

• Get started with a phishing-resistant passwordless authentication deployment
• Ensure that privileged accounts register and use phishing resistant methods
• Deploy a Conditional Access policy to target privileged accounts and require phishing resistant credentials
• Monitor authentication method activity

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Low
Pillar	Identity
Category	Access control
Product	Entra ID
Feature	Conditional Access
Area	Privileged access
ATT&CK	T1566.002 Spearphishing Link, T1557 Adversary-in-the-Middle, T1078.004 Cloud Accounts
Licence	P1
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.