All user sign-in activity uses strong authentication methods

Overview

Attackers might gain access if multifactor authentication (MFA) isn’t universally enforced or if there are exceptions in place. Attackers might gain access by exploiting vulnerabilities of weaker MFA methods like SMS and phone calls through social engineering techniques. These techniques might include SIM swapping or phishing, to intercept authentication codes.

Attackers might use these accounts as entry points into the tenant. By using intercepted user sessions, attackers can disguise their activities as legitimate user actions, evade detection, and continue their attack without raising suspicion. From there, they might attempt to manipulate MFA settings to establish persistence, plan, and execute further attacks based on the privileges of compromised accounts.

Remediation

• Deploy multifactor authentication
• Get started with a phishing-resistant passwordless authentication deployment
• Deploy a Conditional Access policy to require phishing-resistant MFA for all users
• Review authentication methods activity

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Medium
Effort to fix	Medium
Impact on users	Medium
Pillar	Identity
Category	Monitoring
Product	Entra ID
Feature	Conditional Access
Area	Authentication
ATT&CK	T1078.004 Cloud Accounts, T1111 Multi-Factor Authentication Interception, T1566.002 Spearphishing Link
Licence	P1
Tenant	Workforce, External

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.