cirsec Baselines
Esc
Microsoft 365 tenant · Identity & authentication

Protect security information registration with a managed device or MFA

When it fails: Users can register MFA methods with a password alone. Without a Conditional Access policy on security information registration, an attacker holding the password of a user who has no method yet can register their own.

CB-M365-AUTH-019highactivemanualprofile baseline

Description

A Conditional Access policy targets the user action Register security information for All users and grants access only if one of these controls is met: Require device to be marked as compliant, Require Microsoft Entra hybrid joined device, or Require authentication strength set to Multifactor authentication (a Temporary Access Pass satisfies it).

The policy excludes only the emergency access accounts and, if documented, guests (a Temporary Access Pass does not work for guests). It does not exclude trusted locations.

Rationale

Registration is where an MFA method gets bound to an account. Users with a method must already prove it; the gap is accounts with no method, where the password alone lets anyone register. Requiring a managed device or a Temporary Access Pass handed out by the help desk closes it. Since July 2026, the same policy also applies to Windows Hello for Business and macOS Platform SSO registration.

Impact

New users without a managed device need a Temporary Access Pass for their first registration; the onboarding process must issue one. Users replacing a lost phone on a personal device need a pass too.

Applies when

Requires: Microsoft Entra ID P1

Audit

  1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Security Reader.
  2. Browse to Entra ID > Conditional Access > Policies.
  3. Find a policy with State set to On where:
    • Users > Include is All users, and Exclude contains only the emergency access accounts (and guests if documented);
    • Target resources is User actions > Register security information;
    • Network does not exclude trusted locations;
    • Grant requires a compliant device, a hybrid joined device or an MFA authentication strength (one of them, or a subset).
  4. Read-only alternative with Microsoft Graph PowerShell (scope Policy.Read.All): Get-MgIdentityConditionalAccessPolicy | Where-Object { $_.Conditions.Applications.IncludeUserActions -contains 'urn:user:registersecurityinfo' } | Select-Object DisplayName, State, @{n='Grant';e={$_.GrantControls.BuiltInControls}}, @{n='Op';e={$_.GrantControls.Operator}}
  5. Fail if no such policy exists, if it is Report-only or Off, if it excludes trusted locations, or if its grant can be met without a managed device or MFA.

Remediation

  1. Enable the Temporary Access Pass method (one-time use, CB-M365-AUTH-017) and add it to the onboarding process.
  2. As at least a Conditional Access Administrator, browse to Entra ID > Conditional Access > Policies and select New policy.
  3. Name it, for example ALL - Secure security info registration.
  4. Users > Include: All users. Exclude: the emergency access accounts, and All guest and external users if guests are covered otherwise.
  5. Target resources > User actions: Register security information.
  6. Grant > Grant access: select Require authentication strength (Multifactor authentication), Require device to be marked as compliant and Require Microsoft Entra hybrid joined device, then Require one of the selected controls.
  7. Set Enable policy to Report-only, save, review the sign-in logs, then switch to On. Graph equivalent: New-MgIdentityConditionalAccessPolicy with conditions.applications.includeUserActions set to urn:user:registersecurityinfo and grantControls with operator OR.

Rollback

Set the policy to Report-only or Off.

References

Mappings

FrameworkIDRelationNote
NIST SP 800-53 Rev. 55.1.1IA-5related
NIST SP 800-53 Rev. 55.1.1IA-2(2)related
CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0MS.AAD.3.8v1looserSCuBA requires a managed device; we also accept MFA or a Temporary Access Pass.

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1098.005
MITRE ATT&CKT1556.006
  • related CB-M365-AUTH-017 Limit Temporary Access Pass to one-time use
  • related CB-M365-AUTH-018 Make sure every member user has registered an MFA method
  • related CB-M365-AUTH-020 Require a compliant or hybrid joined device to access resources
  • related CB-M365-AUTH-032 Define the organization's trusted network locations
  • related CB-M365-AUTH-041 Require SSPR registration at sign-in and reconfirmation every {{ sspr_reconfirm_days }} days
  • related CB-M365-ADMIN-002 Keep two protected emergency access accounts
  • related CB-M365-AUTH-028 Require a fresh sign-in with MFA for every Intune device enrollment

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr