{ "id": "CB-M365-AUTH-004", "standard": "m365", "version": "main", "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-004", "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-004.json", "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-004.yml", "profiles_effective": [ "baseline", "hardened" ], "license": "Text CC BY 4.0, code Apache-2.0", "attribution": "CIRSEC Baselines, https://baselines.cirsec.org", "control": { "id": "CB-M365-AUTH-004", "title": "Require phishing-resistant MFA for administrative roles", "finding": { "title": "Administrators can sign in with MFA methods that can be phished", "description": "An attacker who relays a password and a push or code prompt through a fake sign-in page gets a privileged session on the tenant." }, "status": "active", "profiles": [ "baseline" ], "risk": { "severity": "critical" }, "assessment": "manual", "tags": [ "mfa", "phishing-resistant", "conditional-access", "privileged-access", "passkeys" ], "applicability": { "requires": [ "Microsoft Entra ID P1" ] }, "description": "A Conditional Access policy requires the built-in **Phishing-resistant MFA** authentication\nstrength for every user holding a privileged directory role, on all resources. Accepted methods\nare passkeys (FIDO2 security keys or Microsoft Authenticator passkeys), Windows Hello for\nBusiness and certificate-based authentication with multifactor binding.\n\nThe policy includes at least these built-in roles: Global Administrator, Privileged Role\nAdministrator, Privileged Authentication Administrator, Security Administrator, Conditional\nAccess Administrator, Exchange Administrator, SharePoint Administrator, User Administrator,\nApplication Administrator, Cloud Application Administrator, Authentication Administrator,\nHelpdesk Administrator, Password Administrator, Billing Administrator and Hybrid Identity\nAdministrator. It excludes only the emergency access accounts (CB-M365-ADMIN-002).\n\nThis control covers plain MFA for administrators: a phishing-resistant method is a stronger form\nof MFA.\n", "rationale": "Push notifications, one-time codes, SMS and voice calls can all be relayed in real time by an\nadversary-in-the-middle phishing kit, which then steals the session cookie. Phishing-resistant\nmethods are bound to the sign-in origin, so a fake page cannot use them. Administrator accounts\nare the first target of these kits because one session is enough to take over the tenant.\n", "impact": "Every administrator must register a passkey, a security key or Windows Hello for Business before\nthe policy is enforced, otherwise they are locked out. Hand out a Temporary Access Pass to\nregister the first method (CB-M365-AUTH-017). Administrators who also work from shared or\nnon-Windows devices need a roaming security key or an Authenticator passkey. External\nauthentication methods cannot be combined with authentication strengths.\n", "notes": "Conditional Access only applies to built-in roles assigned at directory scope. Roles scoped to\nan administrative unit and custom roles are not covered: protect those accounts with a group\nincluded in the same policy. With Privileged Identity Management, the policy applies once the\nrole is active; also require MFA on activation in the role settings.\n", "audit": { "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n Security Reader.\n2. Browse to **Entra ID** > **Conditional Access** > **Policies**.\n3. Find a policy with **State** set to **On** (not Report-only) where:\n - **Users** > **Include** lists **Directory roles** with at least the roles above;\n - **Users** > **Exclude** contains only the emergency access accounts or their group;\n - **Target resources** includes **All resources**, without exclusions;\n - **Grant** is **Require authentication strength** set to **Phishing-resistant MFA** (or a\n custom strength that only allows passkeys, Windows Hello for Business or multifactor\n certificates).\n4. Browse to **Entra ID** > **Monitoring & health** > **Sign-in logs**, filter on an\n administrator, open a recent interactive sign-in and check under **Conditional Access**\n that the policy shows **Success**.\n5. Fail if no such policy exists, if it is in Report-only or Off, or if a privileged role from\n the list is missing.\n" }, "remediation": { "manual": "1. Make sure every administrator has registered a phishing-resistant method: browse to\n **Entra ID** > **Authentication methods** > **User registration details** and filter on the\n administrators. Issue a Temporary Access Pass to those who have none.\n2. Browse to **Entra ID** > **Conditional Access** > **Policies** and select **New policy**.\n3. Name it, for example `ADM - Require phishing-resistant MFA`.\n4. **Users** > **Include** > **Select users and groups** > **Directory roles**: select the roles\n listed above. **Exclude**: select the emergency access accounts.\n5. **Target resources** > **Resources** > **Include**: **All resources**.\n6. **Grant** > **Grant access** > **Require authentication strength** > **Phishing-resistant\n MFA**.\n7. Set **Enable policy** to **Report-only**, save, and review the sign-in logs for a few days\n with the **Report-only** filter.\n8. Switch **Enable policy** to **On**.\n", "rollback": "Set the policy to **Report-only** or **Off**. Sign in with an emergency access account if no\nadministrator can sign in anymore.\n" }, "references": [ { "title": "Require phishing-resistant multifactor authentication for administrators", "url": "https://learn.microsoft.com/entra/identity/conditional-access/policy-admin-phish-resistant-mfa", "publisher": "Microsoft", "kind": "vendor-doc", "accessed": "2026-10-24" }, { "title": "Conditional Access authentication strengths", "url": "https://learn.microsoft.com/entra/identity/authentication/concept-authentication-strengths", "publisher": "Microsoft", "kind": "vendor-doc", "accessed": "2026-10-24" }, { "title": "Baseline security mode settings", "url": "https://learn.microsoft.com/microsoft-365/baseline-security-mode/baseline-security-mode-settings", "publisher": "Microsoft", "kind": "vendor-doc", "accessed": "2026-10-24" } ], "mappings": [ { "framework": "cisa-scuba-m365", "framework_version": "2.0.0", "id": "MS.AAD.3.6v1", "relation": "equivalent" }, { "framework": "anssi-admin", "framework_version": "3.0", "id": "R36", "relation": "stricter", "note": "ANSSI recommends two factors for administration; ours requires phishing-resistant factors." }, { "framework": "anssi-mfa", "framework_version": "2.0", "id": "R2", "relation": "partial", "note": "Applied to administrators only; CB-M365-AUTH-005 extends it to every user." }, { "framework": "nist-800-53r5", "framework_version": "5.1.1", "id": "IA-2(1)", "relation": "related" }, { "framework": "nist-800-53r5", "framework_version": "5.1.1", "id": "IA-2(6)", "relation": "related" } ], "threats": [ { "framework": "mitre-attack", "id": "T1557" }, { "framework": "mitre-attack", "id": "T1539" }, { "framework": "mitre-attack", "id": "T1078.004" } ], "related_controls": [ { "id": "CB-M365-AUTH-005", "type": "related" }, { "id": "CB-M365-AUTH-015", "type": "requires" }, { "id": "CB-M365-AUTH-003", "type": "related" }, { "id": "CB-M365-AUTH-017", "type": "related" }, { "id": "CB-M365-AUTH-024", "type": "related" }, { "id": "CB-M365-ADMIN-002", "type": "related" }, { "id": "CB-M365-AUTH-035", "type": "related" }, { "id": "CB-M365-ADMIN-001", "type": "related" }, { "id": "CB-M365-ADMIN-016", "type": "related" }, { "id": "CB-M365-DEVICE-007", "type": "related" } ], "authors": [ { "name": "Alice", "github": "Sn0wAlice" } ], "introduced_in": "0.1.0", "created": "2026-10-24", "updated": "2026-10-24" } }