{
  "id": "CB-M365-AUTH-013",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-013",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-013.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-013.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-013",
    "title": "Enable system-preferred multifactor authentication",
    "finding": {
      "title": "Users are not steered to their strongest MFA method",
      "description": "Users keep their own default method, often SMS or a phone call, even when they have registered Authenticator or a passkey."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "mfa",
      "system-preferred",
      "authentication-methods"
    ],
    "description": "In the Authentication methods policy settings, **System-preferred multifactor\nauthentication** is set to **Enabled** for **All users**, without exclusions. At sign-in, Entra\nID then asks for the most secure method the user has registered instead of the default the user\nchose.\n\nThe tenant default is **Microsoft managed**. This control asks for **Enabled** explicitly, so\nthe behaviour does not depend on a value Microsoft can change.\n",
    "rationale": "Users rarely change their default method. With phone methods still registered, they keep being\nprompted by SMS or call even after registering Authenticator or a passkey. Choosing the\nstrongest registered method raises the actual strength of MFA without any user action.\n",
    "impact": "Users are prompted with a method they may not be used to; they can still pick another one with\n**Sign in another way**. **Enabled** applies to the second factor only; **Microsoft managed**\nalso applies it to the first factor.\n",
    "setting": {
      "location": "Microsoft Entra admin center > Entra ID > Authentication methods > Settings > System-preferred multifactor authentication",
      "default_value": "Microsoft managed",
      "recommended_value": "Enabled, All users"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Authentication methods** > **Settings**.\n3. Read **System-preferred multifactor authentication**, its target and exclusions.\n4. Read-only alternative with Microsoft Graph PowerShell (scope `Policy.Read.All`):\n   `(Get-MgPolicyAuthenticationMethodPolicy).SystemCredentialPreferences | Format-List`\n5. Fail if the state is not **Enabled** (`enabled`), if the target is not all users, or if a\n   group is excluded.\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy\n   Administrator.\n2. Browse to **Entra ID** > **Authentication methods** > **Settings**.\n3. Set **System-preferred multifactor authentication** to **Enabled**, include **All users**,\n   remove exclusions and save.\nGraph equivalent: `PATCH /policies/authenticationMethodsPolicy` with\n`systemCredentialPreferences` set to `{\"state\": \"enabled\", \"includeTargets\": [{\"targetType\": \"group\", \"id\": \"all_users\"}], \"excludeTargets\": []}`.\n",
      "rollback": "Set the setting back to **Microsoft managed**.\n"
    },
    "references": [
      {
        "title": "System-preferred multifactor authentication",
        "url": "https://learn.microsoft.com/entra/identity/authentication/concept-system-preferred-authentication",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-2(2)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-5",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-011",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}