Detections
Analytics

MS.AAD.3.7v1 - Managed devices SHOULD be required for authentication.

Information

The security risk of an adversary authenticating to the tenant from their own device is reduced by requiring a managed device to authenticate. Managed devices are under the provisioning and control of the agency. [OMB-22-09](https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf) states, "When authorizing users to access resources, agencies must consider at least one device-level signal alongside identity information about the authenticated user."

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

1. Create a conditional access policy requiring a user's device to be either Microsoft Entra ID hybrid joined or compliant during authentication. Configure the following policy settings in the new conditional access policy, per the values below:

 Users > Include > All users

 Target resources > Include > All resources (formerly 'All cloud apps')

 Access controls > Grant > Grant Access > Require device to be marked as compliant and Require Microsoft Entra ID hybrid joined device > For multiple controls > Require one of the selected controls

See Also

https://github.com/cisagov/ScubaGear/tree/v1.8.0/

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION

References: 800-53|AC-20, 800-53|IA-3

Plugin: microsoft_azure

Control ID: 4acf3d0f77051f22737c00ed9e16489dbc38f2416d1fdcade8c84abd0237f5b4