All user sign in activity uses phishing-resistant authentication methods
Overview
Section titled “Overview”Phishing-resistant authentication methods like passkeys and FIDO2 security keys provide the strongest protection against credential theft and sophisticated phishing attacks. Traditional MFA methods remain vulnerable to adversary-in-the-middle attacks and social engineering. Enforcing phishing-resistant methods for all users through Conditional Access policies helps prevent unauthorized access even when attackers attempt to intercept authentication flows.
Remediation
Section titled “Remediation”- Configure Conditional Access for all users with MFA strength
- Deploy phishing-resistant passwordless authentication
Run it
Section titled “Run it”The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
Install-Module ZeroTrustAssessment -Scope CurrentUserConnect-MaesterInvoke-Maester -Pack ZTA -SkipBuiltInLeave out -SkipBuiltIn to run Maester’s own checks in the same run.
About this check
| Severity | Medium |
| Effort to fix | Medium |
| Impact on users | Low |
| Pillar | Identity |
| Category | Access control |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| ATT&CK | T1566.002 Spearphishing Link, T1557 Adversary-in-the-Middle, T1111 Multi-Factor Authentication Interception |
| Licence | P1 |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.
A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.