Detections
Analytics

5.2.3.5 (L1) Ensure weak authentication methods are disabled

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Authentication methods support a wide variety of scenarios for signing in to Microsoft 365 resources. Some of these methods are inherently more secure than others but require more investment in time to get users enrolled and operational.

SMS and Voice Call rely on telephony carrier communication methods to deliver the authenticating factor.

The email one-time passcode feature is a way to authenticate B2B collaboration users when they can't be authenticated through other means, such as Microsoft Entra ID, Microsoft account (MSA), or social identity providers. When a B2B guest user tries to redeem your invitation or sign in to your shared resources, they can request a temporary passcode, which is sent to their email address. Then they enter this passcode to continue signing in.

The recommended state is to Disable these methods:

 - SMS
 - Voice Call
 - Email OTP

The SMS and Voice call methods are vulnerable to SIM swapping which could allow an attacker to gain access to your Microsoft 365 account.

Solution

To remediate using the UI:

 - Navigate to Microsoft Entra admin center https://entra.microsoft.com/.
 - Click to expand Protection select Authentication methods.
 - Select Policies.
 - Inspect each method that is out of compliance and remediate:
 - Click on the method to open it.
 - Change the Enable toggle to the off position.
 - Click Save.

Note: If the save button remains greyed out after toggling a method off, then first turn it back on and then change the position of the Target selection (all users or select groups). Turn the method off again and save. This was observed to be a bug in the UI at the time this document was published.

To remediate using Powershell:

 - Connect to Graph using Connect-MgGraph -Scopes "Policy.ReadWrite.AuthenticationMethod"
 - Run the following to disable all three authentication methods:

$params = @(
 @{ Id = "Sms"; State = "disabled" },
 @{ Id = "Voice"; State = "disabled" },
 @{ Id = "Email"; State = "disabled" }
)

Update-MgPolicyAuthenticationMethodPolicy -AuthenticationMethodConfigurations $params

Impact:

Disabling Email OTP will prevent one-time pass codes from being sent to unverified guest users accessing Microsoft 365 resources on the tenant such as "@yahoo.com". They will be required to use a personal Microsoft account, a managed Microsoft Entra account, be part of a federation or be configured as a guest in the host tenant's Microsoft Entra ID.

See Also

https://workbench.cisecurity.org/benchmarks/20006

Item Details

Plugin: microsoft_azure

Control ID: 0129b90afe77d2c47d968ccba031dbce2b80f34a63afe849d8a4e957bf57dec7