Detections
Analytics

MS.AAD.3.1v1 - Phishing-resistant MFA SHALL be enforced for all users.

Information

Weaker forms of MFA do not protect against sophisticated phishing attacks. By enforcing methods resistant to phishing, those risks are minimized.

Solution

1. Create a conditional access policy enforcing phishing-resistant MFA for all users. Configure the following policy settings in the new conditional access policy, per the values below:

 Users > Include > All users

 Target resources > Include > All resources (formerly 'All cloud apps')

 Access controls > Grant > Grant Access > Require authentication strength > Phishing-resistant MFA

See Also

https://github.com/cisagov/ScubaGear/tree/v1.8.0/

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-2(1), 800-53|IA-2(2), 800-53|IA-2(8), 800-53|IA-5c., 800-53|IA-5h.

Plugin: microsoft_azure

Control ID: 507662fe5f3f457d7ef3a14004b27e27635e6e98e3a27cd66a77626f3d4f0837