Enable Microsoft Entra ID Protection policy to enforce multifactor authentication registration
ZTA.21893LowEntra IDIdentity ProtectionPreview 3.0
Overview
Section titled “Overview”Require multifactor authentication (MFA) registration for all users. Based on studies, your account is more than 99% less likely to be compromised if you’re using MFA. Even if you don’t require MFA all the time, this policy ensures your users are ready when it’s needed.
Remediation
Section titled “Remediation”Run it
Section titled “Run it”The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
Install-Module ZeroTrustAssessment -Scope CurrentUserConnect-MaesterInvoke-Maester -Pack ZTA -SkipBuiltInLeave out -SkipBuiltIn to run Maester’s own checks in the same run.
About this check
| Severity | Low |
| Effort to fix | Medium |
| Impact on users | Medium |
| Pillar | Identity |
| Category | Access control |
| Product | Entra ID |
| Feature | Identity Protection |
| Area | Authentication |
| ATT&CK | T1078.004 Cloud Accounts, T1098.005 Device Registration |
| Licence | P2 |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.
A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.