Detections
Analytics

MS.AAD.3.8v1 - Managed Devices SHOULD be required to register MFA.

Information

Reduce risk of an adversary using stolen user credentials and then registering their own MFA device to access the tenant by requiring a managed device provisioned and controlled by the agency to perform registration actions. This prevents the adversary from using their own unmanaged device to perform the registration.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

1. Create a conditional access policy requiring a user to be on a managed device when registering for MFA. Configure the following policy settings in the new conditional access policy, per the values below:

 Users > Include > All users

 Target resources > User actions > Register security information

 Access controls > Grant > Grant Access > Require device to be marked as compliant and Require Microsoft Entra ID hybrid joined device > For multiple controls > Require one of the selected controls

See Also

https://github.com/cisagov/ScubaGear/tree/v1.8.0/

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION

References: 800-53|AC-20, 800-53|IA-3

Plugin: microsoft_azure

Control ID: 12bc0e98402291a9ca6d1578583b1168a1fe34cd435eae3c2a6ac291b8522377