Require phishing-resistant MFA for administrative roles

Description

A Conditional Access policy requires the built-in Phishing-resistant MFA authentication strength for every user holding a privileged directory role, on all resources. Accepted methods are passkeys (FIDO2 security keys or Microsoft Authenticator passkeys), Windows Hello for Business and certificate-based authentication with multifactor binding.

The policy includes at least these built-in roles: Global Administrator, Privileged Role Administrator, Privileged Authentication Administrator, Security Administrator, Conditional Access Administrator, Exchange Administrator, SharePoint Administrator, User Administrator, Application Administrator, Cloud Application Administrator, Authentication Administrator, Helpdesk Administrator, Password Administrator, Billing Administrator and Hybrid Identity Administrator. It excludes only the emergency access accounts (CB-M365-ADMIN-002).

This control covers plain MFA for administrators: a phishing-resistant method is a stronger form of MFA.

Conditional Access only applies to built-in roles assigned at directory scope. Roles scoped to an administrative unit and custom roles are not covered: protect those accounts with a group included in the same policy. With Privileged Identity Management, the policy applies once the role is active; also require MFA on activation in the role settings.

Rationale

Push notifications, one-time codes, SMS and voice calls can all be relayed in real time by an adversary-in-the-middle phishing kit, which then steals the session cookie. Phishing-resistant methods are bound to the sign-in origin, so a fake page cannot use them. Administrator accounts are the first target of these kits because one session is enough to take over the tenant.

Impact

Every administrator must register a passkey, a security key or Windows Hello for Business before the policy is enforced, otherwise they are locked out. Hand out a Temporary Access Pass to register the first method (CB-M365-AUTH-017). Administrators who also work from shared or non-Windows devices need a roaming security key or an Authenticator passkey. External authentication methods cannot be combined with authentication strengths.

Applies when

Requires: Microsoft Entra ID P1

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Security Reader.
2. Browse to Entra ID > Conditional Access > Policies.
3. Find a policy with State set to On (not Report-only) where:
   • Users > Include lists Directory roles with at least the roles above;
   • Users > Exclude contains only the emergency access accounts or their group;
   • Target resources includes All resources, without exclusions;
   • Grant is Require authentication strength set to Phishing-resistant MFA (or a custom strength that only allows passkeys, Windows Hello for Business or multifactor certificates).
4. Browse to Entra ID > Monitoring & health > Sign-in logs, filter on an administrator, open a recent interactive sign-in and check under Conditional Access that the policy shows Success.
5. Fail if no such policy exists, if it is in Report-only or Off, or if a privileged role from the list is missing.

Remediation

1. Make sure every administrator has registered a phishing-resistant method: browse to Entra ID > Authentication methods > User registration details and filter on the administrators. Issue a Temporary Access Pass to those who have none.
2. Browse to Entra ID > Conditional Access > Policies and select New policy.
3. Name it, for example ADM - Require phishing-resistant MFA.
4. Users > Include > Select users and groups > Directory roles: select the roles listed above. Exclude: select the emergency access accounts.
5. Target resources > Resources > Include: All resources.
6. Grant > Grant access > Require authentication strength > Phishing-resistant MFA.
7. Set Enable policy to Report-only, save, and review the sign-in logs for a few days with the Report-only filter.
8. Switch Enable policy to On.

Rollback

Set the policy to Report-only or Off. Sign in with an emergency access account if no administrator can sign in anymore.

References

• Require phishing-resistant multifactor authentication for administrators Microsoft, vendor-doc, accessed 2026-10-24
• Conditional Access authentication strengths Microsoft, vendor-doc, accessed 2026-10-24
• Baseline security mode settings Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-AUTH-005 Require phishing-resistant MFA for all users
• requires CB-M365-AUTH-015 Enable passkeys and enforce attestation for administrators
• related CB-M365-AUTH-003 Require MFA for all users on all resources
• related CB-M365-AUTH-017 Limit Temporary Access Pass to one-time use
• related CB-M365-AUTH-024 Limit administrator sessions with sign-in frequency and non-persistent browsers
• related CB-M365-ADMIN-002 Keep two protected emergency access accounts
• related CB-M365-AUTH-035 Do not force periodic password expiration
• related CB-M365-ADMIN-001 Use dedicated, named, cloud-only accounts for administrative roles
• related CB-M365-ADMIN-016 Require a dedicated administration workstation for administrative roles
• related CB-M365-DEVICE-007 Enable Windows LAPS backup to Microsoft Entra ID

People and lifecycle