Multi-factor Authentication

E8-MFA · Maturity Level 0

E8-MFA-01partialML signal: 1

Evidence

{
  "totalUsers": 5,
  "mfaRegisteredUsers": 4,
  "registrationRate": 0.8
}

MFA Registration Coverage

What this checks

The percentage of users who have registered at least one MFA method in Entra ID. ML1 requires 50 %+ registration; ML2 requires 100 % (all users registered).

Remediation

Enable the combined registration experience in Entra ID > User settings > Manage user feature settings.
Run a registration campaign via Entra ID > Authentication methods > Registration campaign to nudge unregistered users.
Set a deadline for registration and enforce it via a Conditional Access policy that blocks sign-in for users without MFA registered after the deadline.
Identify unregistered users via Entra ID > Reports > Authentication methods > User registration details and contact them directly.
Exclude shared/service accounts from the registration requirement by placing them in a dedicated group excluded from MFA policies, then reduce their permissions.

E8-MFA-02passML signal: 2

Evidence

{
  "matchingPolicyNames": [
    "Require MFA for all users"
  ]
}

MFA Enforced for All Users (Conditional Access)

What this checks

Whether an enabled Conditional Access policy exists that targets all users and grants access only when MFA is satisfied. This is the ML2 enforcement gate.

Remediation

In Entra ID > Security > Conditional Access, create a new policy.
Set Users → Include: All users. Exclude break-glass accounts by group.
Set Cloud apps → Include: All cloud apps (or scope to M365 services at minimum).
Set Grant → Grant access → Require multifactor authentication.
Enable the policy in Report-only mode first to validate impact before switching to On.
Combine with a sign-in risk policy to step up MFA for risky sign-ins (best practice at ML3).

E8-MFA-03passML signal: 2

Evidence

{
  "matchingPolicyNames": [
    "Require MFA for privileged roles"
  ]
}

MFA Enforced for Privileged Roles (Conditional Access)

What this checks

Whether an enabled Conditional Access policy targets one or more directory roles (privileged accounts) and requires MFA. Privileged role enforcement is a distinct ML2 requirement from the all-users policy.

Remediation

Create a dedicated Conditional Access policy for privileged users in Entra ID > Security > Conditional Access.
Set Users → Include: Directory roles → select Global Administrator, Privileged Role Administrator, Exchange Administrator, SharePoint Administrator, and any other high-privilege roles in your tenant.
Set Grant → Require multifactor authentication (consider also requiring compliant device and app protection policy for ML3).
Do not merge this with the all-users policy — a separate policy makes audit and exclusion management cleaner.
Review the role list at least quarterly; newly assigned privileged roles should be added to this policy.

E8-MFA-04passML signal: 1

Evidence

{
  "matchingPolicyNames": [
    "Block legacy authentication"
  ]
}

Legacy Authentication Blocked

What this checks

Whether an enabled Conditional Access policy explicitly blocks legacy authentication clients (Exchange ActiveSync, older IMAP/POP/SMTP clients, and other legacy protocols that cannot complete MFA challenges).

Remediation

In Entra ID > Security > Conditional Access, create a new policy named "Block legacy authentication".
Set Users → Include: All users.
Set Cloud apps → Include: All cloud apps.
Set Conditions > Client apps → enable Exchange ActiveSync clients and Other clients.
Set Grant → Block access.
Before enabling, use Sign-in logs filtered by "Legacy authentication" to identify any services still using legacy protocols and migrate them to modern auth.
Common legacy auth users: older on-premises mail clients, some PowerShell modules (use `-UseModernAuth` or certificate-based auth instead), and third-party integrations.

E8-MFA-05partialML signal: 0

Evidence

{
  "adminCount": 2,
  "adminsWithPhishingResistant": 1
}

Phishing-Resistant MFA for Admins

What this checks

Whether all admin users (those marked `isAdmin` in the authentication methods registration report) have registered a phishing-resistant method — FIDO2 security key, Windows Hello for Business, or certificate-based authentication. Required for ML3.

Remediation

Enable FIDO2 security keys in Entra ID > Security > Authentication methods > FIDO2 security key policy — set to Enabled for a group containing all administrators.
Deploy Windows Hello for Business via Intune for administrator workstations — configure the WHfB policy under Endpoint security > Account protection.
Create a Conditional Access policy for admin roles that requires an Authentication strength of "Phishing-resistant MFA" (Entra ID P2 required).
Procure hardware keys for all Global Administrators, Privileged Role Administrators, and other Tier-0 roles before enforcing the policy.
After rollout, re-run this check to confirm all admins have phishing-resistant methods registered.

Remediation

Enable the combined registration experience in Entra ID > User settings > Manage user feature settings.

Run a registration campaign via Entra ID > Authentication methods > Registration campaign to nudge unregistered users.

Set a deadline for registration and enforce it via a Conditional Access policy that blocks sign-in for users without MFA registered after the deadline.

Identify unregistered users via Entra ID > Reports > Authentication methods > User registration details and contact them directly.

Exclude shared/service accounts from the registration requirement by placing them in a dedicated group excluded from MFA policies, then reduce their permissions.

Remediation

In Entra ID > Security > Conditional Access, create a new policy.

Set Users → Include: All users. Exclude break-glass accounts by group.

Set Cloud apps → Include: All cloud apps (or scope to M365 services at minimum).

Set Grant → Grant access → Require multifactor authentication.

Enable the policy in Report-only mode first to validate impact before switching to On.

Combine with a sign-in risk policy to step up MFA for risky sign-ins (best practice at ML3).

Remediation

Create a dedicated Conditional Access policy for privileged users in Entra ID > Security > Conditional Access.

Set Users → Include: Directory roles → select Global Administrator, Privileged Role Administrator, Exchange Administrator, SharePoint Administrator, and any other high-privilege roles in your tenant.

Set Grant → Require multifactor authentication (consider also requiring compliant device and app protection policy for ML3).

Do not merge this with the all-users policy — a separate policy makes audit and exclusion management cleaner.

Review the role list at least quarterly; newly assigned privileged roles should be added to this policy.

Remediation

In Entra ID > Security > Conditional Access, create a new policy named "Block legacy authentication".

Set Users → Include: All users.

Set Cloud apps → Include: All cloud apps.

Set Conditions > Client apps → enable Exchange ActiveSync clients and Other clients.

Set Grant → Block access.

Before enabling, use Sign-in logs filtered by "Legacy authentication" to identify any services still using legacy protocols and migrate them to modern auth.

Common legacy auth users: older on-premises mail clients, some PowerShell modules (use `-UseModernAuth` or certificate-based auth instead), and third-party integrations.

Remediation

Enable FIDO2 security keys in Entra ID > Security > Authentication methods > FIDO2 security key policy — set to Enabled for a group containing all administrators.

Deploy Windows Hello for Business via Intune for administrator workstations — configure the WHfB policy under Endpoint security > Account protection.

Create a Conditional Access policy for admin roles that requires an Authentication strength of "Phishing-resistant MFA" (Entra ID P2 required).

Procure hardware keys for all Global Administrators, Privileged Role Administrators, and other Tier-0 roles before enforcing the policy.

After rollout, re-run this check to confirm all admins have phishing-resistant methods registered.