{
  "id": "CB-M365-AUTH-009",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-009",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-009.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-009.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-009",
    "title": "Complete the migration to the Authentication methods policy",
    "finding": {
      "title": "Legacy MFA and SSPR policies still decide which methods users can use",
      "description": "While the migration state is not Migration Complete, a method disabled in the Authentication methods policy can stay usable through the legacy MFA or SSPR settings."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "authentication-methods",
      "mfa",
      "sspr",
      "migration"
    ],
    "description": "The Authentication methods policy is the only place that decides which methods users can\nregister and use: its **Manage migration** state is **Migration Complete**. The legacy per-user\nMFA service settings (verification options) and the legacy SSPR methods are then ignored.\n\nEvery method that users still need is enabled in the Authentication methods policy before the\nswitch, and the other controls of this standard on methods (SMS, Voice call, Email OTP,\nSoftware OATH tokens, Passkey (FIDO2), Temporary Access Pass) are set there.\n",
    "rationale": "During migration, Entra ID honours the union of the legacy policies and the new one. A weak\nmethod disabled in the new policy, such as SMS, stays usable if the legacy MFA or SSPR policy\nstill allows it. Microsoft stopped managing methods in the legacy policies on 30 September\n2025; finishing the migration removes the ambiguity.\n",
    "impact": "Users lose any method that was only allowed by the legacy policies. Compare both sides first,\nor run the automated migration guide, which copies the legacy settings into the new policy.\nSecurity questions for SSPR stay in the legacy SSPR policy.\n",
    "setting": {
      "location": "Microsoft Entra admin center > Entra ID > Authentication methods > Policies > Manage migration",
      "default_value": "Pre-migration on older tenants",
      "recommended_value": "Migration Complete"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Authentication methods** > **Policies**.\n3. Read the migration banner or select **Manage migration** to see the current state.\n4. Read-only alternative with Microsoft Graph PowerShell (scope `Policy.Read.All`):\n   `(Get-MgPolicyAuthenticationMethodPolicy).PolicyMigrationState`\n   (Graph: `GET https://graph.microsoft.com/v1.0/policies/authenticationMethodsPolicy`).\n5. Fail if the state is not **Migration Complete** (`migrationComplete`).\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy\n   Administrator.\n2. Record the legacy settings: **Entra ID** > **Users** > **Per-user MFA** > **service\n   settings** (verification options) and **Entra ID** > **Password reset** >\n   **Authentication methods**.\n3. Browse to **Entra ID** > **Authentication methods** > **Policies** and either run the\n   automated migration guide, or enable by hand each method still needed, for the right\n   groups.\n4. Select **Manage migration** > **Migration in progress**, check sign-ins and password resets\n   for a few days, then select **Migration Complete** and save.\nGraph equivalent: `PATCH /policies/authenticationMethodsPolicy` with\n`\"policyMigrationState\": \"migrationComplete\"`.\n",
      "rollback": "Set **Manage migration** back to **Migration in progress**; the legacy policies apply again.\n"
    },
    "references": [
      {
        "title": "How to migrate MFA and SSPR policy settings to the Authentication methods policy",
        "url": "https://learn.microsoft.com/entra/identity/authentication/how-to-authentication-methods-manage",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Manage authentication methods for Microsoft Entra ID",
        "url": "https://learn.microsoft.com/entra/identity/authentication/concept-authentication-methods-manage",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft Entra ID baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.AAD.3.4v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-5",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-6",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-007",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-010",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-011",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-039",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}