{
  "id": "CB-M365-AUTH-019",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-019",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-019.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-019.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-019",
    "title": "Protect security information registration with a managed device or MFA",
    "finding": {
      "title": "Users can register MFA methods with a password alone",
      "description": "Without a Conditional Access policy on security information registration, an attacker holding the password of a user who has no method yet can register their own."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "mfa",
      "registration",
      "conditional-access",
      "temporary-access-pass",
      "managed-device"
    ],
    "applicability": {
      "requires": [
        "Microsoft Entra ID P1"
      ]
    },
    "description": "A Conditional Access policy targets the user action **Register security information** for\n**All users** and grants access only if **one** of these controls is met: **Require device to\nbe marked as compliant**, **Require Microsoft Entra hybrid joined device**, or **Require\nauthentication strength** set to **Multifactor authentication** (a Temporary Access Pass\nsatisfies it).\n\nThe policy excludes only the emergency access accounts and, if documented, guests (a Temporary\nAccess Pass does not work for guests). It does not exclude trusted locations.\n",
    "rationale": "Registration is where an MFA method gets bound to an account. Users with a method must already\nprove it; the gap is accounts with no method, where the password alone lets anyone register.\nRequiring a managed device or a Temporary Access Pass handed out by the help desk closes it.\nSince July 2026, the same policy also applies to Windows Hello for Business and macOS Platform\nSSO registration.\n",
    "impact": "New users without a managed device need a Temporary Access Pass for their first registration;\nthe onboarding process must issue one. Users replacing a lost phone on a personal device need\na pass too.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Security Reader.\n2. Browse to **Entra ID** > **Conditional Access** > **Policies**.\n3. Find a policy with **State** set to **On** where:\n   - **Users** > **Include** is **All users**, and **Exclude** contains only the emergency\n     access accounts (and guests if documented);\n   - **Target resources** is **User actions** > **Register security information**;\n   - **Network** does not exclude trusted locations;\n   - **Grant** requires a compliant device, a hybrid joined device or an MFA authentication\n     strength (one of them, or a subset).\n4. Read-only alternative with Microsoft Graph PowerShell (scope `Policy.Read.All`):\n   `Get-MgIdentityConditionalAccessPolicy | Where-Object { $_.Conditions.Applications.IncludeUserActions -contains 'urn:user:registersecurityinfo' } | Select-Object DisplayName, State, @{n='Grant';e={$_.GrantControls.BuiltInControls}}, @{n='Op';e={$_.GrantControls.Operator}}`\n5. Fail if no such policy exists, if it is Report-only or Off, if it excludes trusted\n   locations, or if its grant can be met without a managed device or MFA.\n"
    },
    "remediation": {
      "manual": "1. Enable the Temporary Access Pass method (one-time use, CB-M365-AUTH-017) and add it to the\n   onboarding process.\n2. As at least a Conditional Access Administrator, browse to **Entra ID** >\n   **Conditional Access** > **Policies** and select **New policy**.\n3. Name it, for example `ALL - Secure security info registration`.\n4. **Users** > **Include**: **All users**. **Exclude**: the emergency access accounts, and\n   **All guest and external users** if guests are covered otherwise.\n5. **Target resources** > **User actions**: **Register security information**.\n6. **Grant** > **Grant access**: select **Require authentication strength** (Multifactor\n   authentication), **Require device to be marked as compliant** and **Require Microsoft Entra\n   hybrid joined device**, then **Require one of the selected controls**.\n7. Set **Enable policy** to **Report-only**, save, review the sign-in logs, then switch to\n   **On**.\nGraph equivalent: `New-MgIdentityConditionalAccessPolicy` with\n`conditions.applications.includeUserActions` set to `urn:user:registersecurityinfo` and\n`grantControls` with operator `OR`.\n",
      "rollback": "Set the policy to **Report-only** or **Off**.\n"
    },
    "references": [
      {
        "title": "Control security information registration with Conditional Access",
        "url": "https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-security-info-registration",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft Entra ID baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.AAD.3.8v1",
        "relation": "looser",
        "note": "SCuBA requires a managed device; we also accept MFA or a Temporary Access Pass."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-5",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-2(2)",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1098.005"
      },
      {
        "framework": "mitre-attack",
        "id": "T1556.006"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-017",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-018",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-020",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-032",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-041",
        "type": "related"
      },
      {
        "id": "CB-M365-ADMIN-002",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-028",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}