{
  "id": "CB-M365-AUTH-018",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-018",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-018.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-018.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-018",
    "title": "Make sure every member user has registered an MFA method",
    "finding": {
      "title": "Some member users have no MFA method registered",
      "description": "An account without a registered method can be claimed by whoever first signs in with its password, who then registers their own method."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "mfa",
      "registration",
      "registration-campaign",
      "authentication-methods"
    ],
    "description": "Every enabled member user is **MFA capable**: they have registered at least one method allowed\nby the Authentication methods policy and usable for MFA. The only exceptions are new accounts\nwaiting for their first registration with a Temporary Access Pass, and accounts that never sign\nin interactively (shared mailboxes with sign-in blocked, resource accounts), which are blocked\nfrom sign-in.\n\nA registration campaign in the Authentication methods policy keeps nudging users who are not\nyet registered.\n",
    "rationale": "MFA policies only protect users who have a method. An unregistered account is the easiest\ntakeover: an attacker with the password signs in, is asked to register, and registers their own\nphone or passkey.\n",
    "impact": "None known for users. The help desk must follow up the users found, and service accounts that\nstill sign in interactively must be replaced with workload identities or blocked.\n",
    "notes": "The **User registration details** report needs Entra ID P1. Without it, check each user's\nmethods with `Get-MgUserAuthenticationMethod`.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Reports Reader (Security Reader and Global Reader also work).\n2. Browse to **Entra ID** > **Authentication methods** > **User registration details**.\n3. Filter **User type** on **Member** and **MFA capable** on **Not capable**.\n4. Read-only alternative with Microsoft Graph PowerShell (scope `AuditLog.Read.All`):\n   `Get-MgReportAuthenticationMethodUserRegistrationDetail -All -Filter \"userType eq 'member' and isMfaCapable eq false\" | Select-Object UserPrincipalName, MethodsRegistered`\n5. Compare the result with the enabled accounts (disabled accounts are not listed).\n6. Fail if an enabled member that can sign in is not MFA capable and is not a new account\n   waiting for its first registration.\n"
    },
    "remediation": {
      "manual": "1. Export the list of members who are not MFA capable and contact them, or issue a Temporary\n   Access Pass so they register a method.\n2. Block sign-in on accounts that should never sign in interactively (**Entra ID** > **Users**\n   > user > **Edit properties** > **Settings** > **Account enabled** off, role User\n   Administrator).\n3. As an Authentication Policy Administrator, browse to **Entra ID** > **Authentication\n   methods** > **Registration campaign**, set **State** to **Enabled** (or keep **Microsoft\n   managed**), target the method you deploy (passkeys or Microsoft Authenticator) for **All\n   users**, and save.\nGraph equivalent for the campaign: `PATCH /policies/authenticationMethodsPolicy` with\n`registrationEnforcement.authenticationMethodsRegistrationCampaign`.\n",
      "rollback": "Set the registration campaign back to **Microsoft managed**.\n"
    },
    "references": [
      {
        "title": "Authentication methods activity",
        "url": "https://learn.microsoft.com/entra/identity/authentication/howto-authentication-methods-activity",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Run a registration campaign to set up authentication methods",
        "url": "https://learn.microsoft.com/entra/identity/authentication/how-to-mfa-registration-campaign",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-2(1)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-2(2)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-5",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      },
      {
        "framework": "mitre-attack",
        "id": "T1098.005"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-003",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-019",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-030",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-031",
        "type": "related"
      },
      {
        "id": "CB-M365-APPS-012",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}