# Step-up authentication is required upon risky in-session action
Initial sign-in multifactor authentication is no longer sufficient against adversary-in-the-middle phishing kits and token theft, which let a threat actor…
Source: https://maester.dev/docs/tests/ZTA.41083
## Overview
Initial sign-in multifactor authentication is no longer sufficient against adversary-in-the-middle phishing kits and token theft, which let a threat actor replay an authenticated cloud app session hours or days later without ever facing another prompt. Closing that gap takes two products: Microsoft Defender for Cloud Apps routes sensitive sessions through Conditional Access App Control and applies a session policy that recognizes a risky in-session action, and Microsoft Entra Conditional Access enforces the resulting step-up challenge with a risk condition plus a phishing-resistant authentication strength such as passkey, FIDO2, or Windows Hello for Business. This check verifies the Entra enforcement leg: that at least one enabled Conditional Access policy combines an identity risk condition with a phishing-resistant authentication strength grant control — the built-in Phishing-resistant MFA strength, or a custom strength whose allowed combinations only use FIDO2, certificate-based authentication (multifactor), or Windows Hello for Business. The Defender for Cloud Apps session policy that triggers the challenge is configured in the Defender portal and is not exposed through Microsoft Graph, so confirm it manually.
## Remediation
- [Common Conditional Access policy: Sign-in risk-based multifactor authentication](https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-risk-based-sign-in)
- [Configure and enable risk policies](https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-risk-policies)
- [Conditional Access authentication strength](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strengths)
- [Risk-based access policies](https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-policies)
- [Protect apps with Microsoft Defender for Cloud Apps Conditional Access App Control](https://learn.microsoft.com/en-us/defender-cloud-apps/proxy-intro-aad)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Medium |
| Impact on users | Medium |
| Pillar | SecOps |
| Category | Identity threat protection |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Conditional Access |
| Area | Authentication |
| ATT&CK | [T1557](/docs/tests?mitre=T1557) Adversary-in-the-Middle, [T1550.004](/docs/tests?mitre=T1550.004) Web Session Cookie, [T1539](/docs/tests?mitre=T1539) Steal Web Session Cookie |
| Licence | ADALLOM_S_STANDALONE&AAD_PREMIUM_P2 |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.