cirsec Baselines
Esc
Microsoft 365 tenant · Identity & authentication

Enable system-preferred multifactor authentication

When it fails: Users are not steered to their strongest MFA method. Users keep their own default method, often SMS or a phone call, even when they have registered Authenticator or a passkey.

CB-M365-AUTH-013mediumactivemanualprofile baseline

Description

In the Authentication methods policy settings, System-preferred multifactor authentication is set to Enabled for All users, without exclusions. At sign-in, Entra ID then asks for the most secure method the user has registered instead of the default the user chose.

The tenant default is Microsoft managed. This control asks for Enabled explicitly, so the behaviour does not depend on a value Microsoft can change.

Rationale

Users rarely change their default method. With phone methods still registered, they keep being prompted by SMS or call even after registering Authenticator or a passkey. Choosing the strongest registered method raises the actual strength of MFA without any user action.

Impact

Users are prompted with a method they may not be used to; they can still pick another one with Sign in another way. Enabled applies to the second factor only; Microsoft managed also applies it to the first factor.

Setting

LocationMicrosoft Entra admin center > Entra ID > Authentication methods > Settings > System-preferred multifactor authentication
DefaultMicrosoft managed
RecommendedEnabled, All users

Audit

  1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
  2. Browse to Entra ID > Authentication methods > Settings.
  3. Read System-preferred multifactor authentication, its target and exclusions.
  4. Read-only alternative with Microsoft Graph PowerShell (scope Policy.Read.All): (Get-MgPolicyAuthenticationMethodPolicy).SystemCredentialPreferences | Format-List
  5. Fail if the state is not Enabled (enabled), if the target is not all users, or if a group is excluded.

Remediation

  1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.
  2. Browse to Entra ID > Authentication methods > Settings.
  3. Set System-preferred multifactor authentication to Enabled, include All users, remove exclusions and save. Graph equivalent: PATCH /policies/authenticationMethodsPolicy with systemCredentialPreferences set to {"state": "enabled", "includeTargets": [{"targetType": "group", "id": "all_users"}], "excludeTargets": []}.

Rollback

Set the setting back to Microsoft managed.

References

Mappings

FrameworkIDRelation
NIST SP 800-53 Rev. 55.1.1IA-2(2)related
NIST SP 800-53 Rev. 55.1.1IA-5related

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr