Detections
Analytics

MS.AAD.3.5v1 - The authentication methods SMS, Voice Call, and Email One-Time Passcode (OTP) SHALL be disabled.

Information

SMS, voice call, and email OTP are the weakest authenticators. This policy forces users to use stronger MFA methods.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

1. In Microsoft Entra admin center , click Protection > Authentication methods
2. Click on the SMS, Voice Call, and Email OTP authentication methods and disable each of them. Their statuses should be Enabled > No on the Authentication methods > Policies page.

See Also

https://github.com/cisagov/ScubaGear/tree/v1.8.0/

Item Details

Category: CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION

References: 800-53|CM-7b., 800-53|IA-5c.

Plugin: microsoft_azure

Control ID: 5724dbba21e6ca9f268569a150b3e0d06b6d55fa33318152d643eda7197f846e