Secure the MFA registration (My Security Info) page

Maester checks this too

CIS.M365.5.2.2.17 (Ensure authentication transfer is blocked) checks the same setting. Running both reports it twice.

Overview

Blocking authentication transfer in Microsoft Entra ID is a critical security control. It helps protect against token theft and replay attacks by preventing the use of device tokens to silently authenticate on other devices or browsers. When authentication transfer is enabled, a threat actor who gains access to one device can access resources to nonapproved devices, bypassing standard authentication and device compliance checks. When administrators block this flow, organizations can ensure that each authentication request must originate from the original device, maintaining the integrity of the device compliance and user session context.

Remediation

• Deploy a Conditional Access policy to block authentication transfer

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	Identity
Category	Access control
Product	Entra ID
Feature	Conditional Access
Area	Authentication
ATT&CK	T1550.001 Application Access Token, T1078.004 Cloud Accounts
Licence	P1
Tenant	Workforce, External

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.