{
  "id": "CB-M365-AUTH-010",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-010",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-010.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-010.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-010",
    "title": "Disable per-user MFA for every user",
    "finding": {
      "title": "Some users are still in legacy per-user MFA",
      "description": "Users in the Enabled or Enforced per-user MFA state are prompted outside Conditional Access, which makes MFA behaviour hard to predict and can bring back app passwords."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "mfa",
      "per-user-mfa",
      "conditional-access",
      "legacy"
    ],
    "description": "No user has the per-user MFA state **Enabled** or **Enforced**: every user shows **Disabled**,\nand MFA is required by Conditional Access (CB-M365-AUTH-003) or, without Entra ID P1, by\nsecurity defaults (CB-M365-AUTH-002).\n\nThe per-user MFA service settings are not used either: **app passwords** are not allowed,\n**trusted IPs** are empty and **remember multifactor authentication on trusted devices** is\noff.\n",
    "rationale": "Per-user MFA predates Conditional Access. It cannot target applications, devices or risk,\nignores authentication strengths, and with the Enforced state lets users create app passwords\nthat bypass MFA for legacy clients. Mixing it with Conditional Access gives prompts nobody can\nexplain and hides gaps.\n",
    "impact": "Make sure Conditional Access requires MFA for these users before switching them to Disabled,\notherwise they lose MFA. Existing app passwords stop working once the user is no longer\nenforced and app passwords are disallowed.\n",
    "notes": "Microsoft can create a Microsoft-managed Conditional Access policy for per-user MFA users\n(tenants with fewer than 500 of them). It helps the transition but does not remove the\nper-user state.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader (the portal page may require Authentication Policy Administrator; use the\n   Graph call otherwise).\n2. Browse to **Entra ID** > **Users** > **All users** and select **Per-user MFA**.\n3. Filter **Status** on **Enabled**, then on **Enforced**.\n4. Select **service settings** and check app passwords, trusted IPs and remember MFA.\n5. Read-only alternative with Microsoft Graph PowerShell (scope `Policy.Read.All`), per user:\n   `Invoke-MgGraphRequest -Method GET -Uri \"https://graph.microsoft.com/beta/users/$id/authentication/requirements\"`\n   returns `perUserMfaState`.\n6. Fail if any user is **Enabled** or **Enforced**, or if app passwords are allowed.\n"
    },
    "remediation": {
      "manual": "1. Confirm that the Conditional Access MFA policy covers the users found.\n2. As at least an Authentication Policy Administrator, browse to **Entra ID** > **Users** >\n   **All users** > **Per-user MFA**.\n3. Select the users in **Enabled** or **Enforced** and select **Disable MFA**, then confirm.\n4. In **service settings**, select **Do not allow users to create app passwords**, clear\n   trusted IPs and remember MFA, and save.\nGraph equivalent, per user: `PATCH https://graph.microsoft.com/beta/users/{id}/authentication/requirements`\nwith `{\"perUserMfaState\": \"disabled\"}`.\n",
      "rollback": "Set the users back to **Enabled** in **Per-user MFA**.\n"
    },
    "references": [
      {
        "title": "Enable per-user Microsoft Entra multifactor authentication to secure sign-in events",
        "url": "https://learn.microsoft.com/entra/identity/authentication/howto-mfa-userstates",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Microsoft-managed policies",
        "url": "https://learn.microsoft.com/entra/identity/conditional-access/managed-policies",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-2(2)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-6",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-003",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-009",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-046",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}