MFA provides strong protection for accounts against weak or breached passwords. Security best practices and standards recommend that you require MFA for risky sign-ins, for example when the authentication request may not come from the legitimate identity owner.

Multi-Factor Authentication (MFA), formerly known as Two-Factor Authentication (2FA), offers robust protection for accounts against the vulnerabilities associated with weak or compromised passwords. Adhering to <a href="https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-policy-risk">best practices</a> and industry standards, it is advisable to block the authentication or ask for MFA when a user sign-in seems risky according to Microsoft Entra ID Protection criteria.
When an attacker obtains a user password through any means, MFA blocks the authentication by requesting an additional factor such as a time-expiring code from a mobile application, a physical token, a biometric feature, etc.
<a href="https://learn.microsoft.com/en-us/entra/id-protection/overview-identity-protection">Microsoft Entra ID Protection</a>, a feature <a href="https://learn.microsoft.com/en-us/entra/id-protection/overview-identity-protection#license-requirements">requiring</a> Microsoft Entra ID P2 licenses, identifies <a href="https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#sign-in-risk-detections">risky sign-ins</a> within Entra ID. A sign-in risk represents the probability that a given authentication request isn't the authorized identity owner, based on <a href="https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#sign-in-risk-detections">a list of detections</a>. Sign-in risk detection spans 3 <a href="https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#risk-levels">levels</a>:
<ul>
<li>High</li>
<li>Medium</li>
<li>Low</li>
</ul>
Using this sign-in risk level can trigger Multi-Factor Authentication (MFA) through two protective features: Conditional Access Policies and Microsoft Entra ID Protection. Tenable recommends configuring it via a Conditional Access policy (CAP) due to its added benefits, including enhanced diagnostic data, seamless integration with report-only mode, Graph API support, and the ability to incorporate additional Conditional Access attributes, such as sign-in frequency, within the policy. Legacy <a href="https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-risk-policies">risk policies</a> configured in Microsoft Entra ID Protection will <a href="https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-risk-policies#migrate-risk-policies-to-conditional-access">retire on October 1, 2026</a>, and must <a href="https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-risk-policies#migrate-risk-policies-to-conditional-access">migrate to Conditional Access Policies</a>. Therefore, this IoE only checks for Conditional Access Policies.
Based on this recommendation, the IoE ensures there is at least one (or two separate) Conditional Access policies with the following settings:
<ul>
<li>"<a href="https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-users-groups#include-users">Users</a>" set to include "All users".</li>
<li>"<a href="https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-cloud-apps">Target resources</a>" set to "All resources".</li>
<li>"<a href="https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-conditions#client-apps">Conditions &gt; Client apps</a>" set to "No" ("Not configured"). Alternatively, set to "Yes" with all these four options selected: "Browser", "Mobile apps and desktop clients", "Exchange ActiveSync clients", and "Other clients".</li>
<li>"<a href="https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-conditions#sign-in-risk">Conditions &gt; Sign-in risk</a>" set to "Yes", selecting both "High" and "Medium" risk levels. Alternatively, configure two separate policies—one targeting "High" risk and the other targeting "Medium" risk—to achieve the same effect.</li>
<li>"<a href="https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-grant">Grant</a>" set to "Require multifactor authentication" or to "Require authentication strength" with one of the following values: "Multifactor authentication", "Passwordless MFA", or "Phishing-resistant MFA".</li>
<li>"<a href="https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-session-lifetime">Session -&gt; Sign-in frequency</a>" set to "Every time".</li>
<li>Lastly, set "Enable policy" to "On" (not "Off" or "Report-only").</li>
</ul>

Initial Access

Valid Accounts: Cloud Accounts

Privilege Escalation

Account Manipulation

Credential Access

Brute Force: Password Guessing

Brute Force: Password Spraying

Brute Force: Credential Stuffing

Modify Authentication Process: Multi-Factor Authentication

MFA Not Required for Risky Sign-Ins

Detections

Analytics

MFA Not Required for Risky Sign-Ins

HIGH

Version 202608241311

Version 202411071130

Version 202608241311 Aug 24, 2026, 1:11 PM Metadata (Explain that the Microsoft Entra Connect and Cloud Sync service accounts must be excluded from the recommended Conditional Access policy, since they cannot comply with an MFA requirement, and exclude the two directory synchronization roles from the policy created by the remediation script) Release: 202608241311
Version 202411071130 Nov 7, 2024, 11:30 AM New Release: 202411071130