cirsec Baselines
Esc
Microsoft 365 tenant · Identity & authentication

Make sure every member user has registered an MFA method

When it fails: Some member users have no MFA method registered. An account without a registered method can be claimed by whoever first signs in with its password, who then registers their own method.

CB-M365-AUTH-018highactivemanualprofile baseline

Description

Every enabled member user is MFA capable: they have registered at least one method allowed by the Authentication methods policy and usable for MFA. The only exceptions are new accounts waiting for their first registration with a Temporary Access Pass, and accounts that never sign in interactively (shared mailboxes with sign-in blocked, resource accounts), which are blocked from sign-in.

A registration campaign in the Authentication methods policy keeps nudging users who are not yet registered.

The User registration details report needs Entra ID P1. Without it, check each user's methods with Get-MgUserAuthenticationMethod.

Rationale

MFA policies only protect users who have a method. An unregistered account is the easiest takeover: an attacker with the password signs in, is asked to register, and registers their own phone or passkey.

Impact

None known for users. The help desk must follow up the users found, and service accounts that still sign in interactively must be replaced with workload identities or blocked.

Audit

  1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Reports Reader (Security Reader and Global Reader also work).
  2. Browse to Entra ID > Authentication methods > User registration details.
  3. Filter User type on Member and MFA capable on Not capable.
  4. Read-only alternative with Microsoft Graph PowerShell (scope AuditLog.Read.All): Get-MgReportAuthenticationMethodUserRegistrationDetail -All -Filter "userType eq 'member' and isMfaCapable eq false" | Select-Object UserPrincipalName, MethodsRegistered
  5. Compare the result with the enabled accounts (disabled accounts are not listed).
  6. Fail if an enabled member that can sign in is not MFA capable and is not a new account waiting for its first registration.

Remediation

  1. Export the list of members who are not MFA capable and contact them, or issue a Temporary Access Pass so they register a method.
  2. Block sign-in on accounts that should never sign in interactively (Entra ID > Users

    user > Edit properties > Settings > Account enabled off, role User Administrator).

  3. As an Authentication Policy Administrator, browse to Entra ID > Authentication methods > Registration campaign, set State to Enabled (or keep Microsoft managed), target the method you deploy (passkeys or Microsoft Authenticator) for All users, and save. Graph equivalent for the campaign: PATCH /policies/authenticationMethodsPolicy with registrationEnforcement.authenticationMethodsRegistrationCampaign.

Rollback

Set the registration campaign back to Microsoft managed.

References

Mappings

FrameworkIDRelation
NIST SP 800-53 Rev. 55.1.1IA-2(1)related
NIST SP 800-53 Rev. 55.1.1IA-2(2)related
NIST SP 800-53 Rev. 55.1.1IA-5related

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1078.004
MITRE ATT&CKT1098.005
  • related CB-M365-AUTH-003 Require MFA for all users on all resources
  • related CB-M365-AUTH-019 Protect security information registration with a managed device or MFA
  • related CB-M365-AUTH-030 Block or force secure remediation for users at high risk
  • related CB-M365-AUTH-031 Require MFA for risky sign-ins and block sign-ins at the highest risk levels
  • related CB-M365-APPS-012 Restrict and protect owners of privileged applications

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr