Detections
Analytics

5.2.2.17 Ensure authentication transfer is blocked

Information

Authentication transfer is a flow that lets users seamlessly transfer authenticated state from one device to another. For example, users might see a QR code in the desktop version of Outlook that, when scanned on their mobile device, transfers their authenticated state to the mobile device.

The recommended state is to block Authentication transfer.

Blocking authentication transfer helps protect against token theft and replay attacks by preventing the use of device tokens to silently authenticate on other devices or browsers. When authentication transfer is enabled, a threat actor who gains access to one device can access resources to unapproved devices, bypassing standard authentication and device compliance checks. When administrators block this flow, organizations can ensure that each authentication request must originate from the original device, maintaining the integrity of the device compliance and user session context.

Solution

To remediate using the UI:

 - Navigate to the Microsoft Entra admin center https://entra.microsoft.com.
 - Expand Entra ID > Conditional Access.
 - Create a new policy by selecting New policy.

 - Under Users or agents (Preview) include All users.
 - Under Target resources > Resources (formerly cloud apps) include All resources (formerly 'All cloud apps').

 - Under Exclude exclude any break-glass accounts.

 - Under Conditions > Authentication flows set Configure to Yes and check Authentication transfer.

 - Click Save.

 - Under Grant select Block access and click Select.

 - Under Enable policy set it to Report-only until the organization is ready to enable it.
 - Click Create.
 - After allowing the policy to run in Report-only mode for at least one week, review the Sign-in logs for any unexpected impact, then return to the policy and set Enable policy to On.

Impact:

Users will no longer be able to use authentication transfer to sign into mobile versions of Microsoft apps (e.g., scanning a QR code in Outlook desktop to sign into Outlook mobile). Each device will require independent, interactive sign-in subject to applicable Conditional Access policies.

See Also

https://workbench.cisecurity.org/benchmarks/24620

Item Details

Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|AC-17, 800-53|AC-17(1), 800-53|CM-6, 800-53|CM-7, 800-53|SC-7, 800-53|SI-4

Plugin: microsoft_azure

Control ID: 65eef9af4abd253ea1c81ceb37959288c54e696ae6c4888b9e78b3fa0bdd9cc7