# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-AUTH-019
title: Protect security information registration with a managed device or MFA
finding:
  title: Users can register MFA methods with a password alone
  description: Without a Conditional Access policy on security information registration, an attacker holding the password of a user who has no method yet can register their own.
status: active
profiles: [baseline]
risk:
  severity: high
assessment: manual
tags: [mfa, registration, conditional-access, temporary-access-pass, managed-device]

applicability:
  requires:
    - "Microsoft Entra ID P1"

description: |
  A Conditional Access policy targets the user action **Register security information** for
  **All users** and grants access only if **one** of these controls is met: **Require device to
  be marked as compliant**, **Require Microsoft Entra hybrid joined device**, or **Require
  authentication strength** set to **Multifactor authentication** (a Temporary Access Pass
  satisfies it).

  The policy excludes only the emergency access accounts and, if documented, guests (a Temporary
  Access Pass does not work for guests). It does not exclude trusted locations.
rationale: |
  Registration is where an MFA method gets bound to an account. Users with a method must already
  prove it; the gap is accounts with no method, where the password alone lets anyone register.
  Requiring a managed device or a Temporary Access Pass handed out by the help desk closes it.
  Since July 2026, the same policy also applies to Windows Hello for Business and macOS Platform
  SSO registration.
impact: |
  New users without a managed device need a Temporary Access Pass for their first registration;
  the onboarding process must issue one. Users replacing a lost phone on a personal device need
  a pass too.

audit:
  manual: |
    1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a
       Security Reader.
    2. Browse to **Entra ID** > **Conditional Access** > **Policies**.
    3. Find a policy with **State** set to **On** where:
       - **Users** > **Include** is **All users**, and **Exclude** contains only the emergency
         access accounts (and guests if documented);
       - **Target resources** is **User actions** > **Register security information**;
       - **Network** does not exclude trusted locations;
       - **Grant** requires a compliant device, a hybrid joined device or an MFA authentication
         strength (one of them, or a subset).
    4. Read-only alternative with Microsoft Graph PowerShell (scope `Policy.Read.All`):
       `Get-MgIdentityConditionalAccessPolicy | Where-Object { $_.Conditions.Applications.IncludeUserActions -contains 'urn:user:registersecurityinfo' } | Select-Object DisplayName, State, @{n='Grant';e={$_.GrantControls.BuiltInControls}}, @{n='Op';e={$_.GrantControls.Operator}}`
    5. Fail if no such policy exists, if it is Report-only or Off, if it excludes trusted
       locations, or if its grant can be met without a managed device or MFA.

remediation:
  manual: |
    1. Enable the Temporary Access Pass method (one-time use, CB-M365-AUTH-017) and add it to the
       onboarding process.
    2. As at least a Conditional Access Administrator, browse to **Entra ID** >
       **Conditional Access** > **Policies** and select **New policy**.
    3. Name it, for example `ALL - Secure security info registration`.
    4. **Users** > **Include**: **All users**. **Exclude**: the emergency access accounts, and
       **All guest and external users** if guests are covered otherwise.
    5. **Target resources** > **User actions**: **Register security information**.
    6. **Grant** > **Grant access**: select **Require authentication strength** (Multifactor
       authentication), **Require device to be marked as compliant** and **Require Microsoft Entra
       hybrid joined device**, then **Require one of the selected controls**.
    7. Set **Enable policy** to **Report-only**, save, review the sign-in logs, then switch to
       **On**.
    Graph equivalent: `New-MgIdentityConditionalAccessPolicy` with
    `conditions.applications.includeUserActions` set to `urn:user:registersecurityinfo` and
    `grantControls` with operator `OR`.
  rollback: |
    Set the policy to **Report-only** or **Off**.

references:
  - title: Control security information registration with Conditional Access
    url: https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-security-info-registration
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: CISA SCuBA Microsoft Entra ID baseline
    url: https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md
    publisher: CISA
    kind: standard
    accessed: 2026-10-24
mappings:
  - framework: cis-m365
    framework_version: "7.0.0"
    id: "5.2.2.10"
    relation: looser
    note: CIS accepts only a managed device; we also accept MFA, so a Temporary Access Pass works for users without one.
  - framework: cisa-scuba-m365
    framework_version: "2.0.0"
    id: MS.AAD.3.8v1
    relation: looser
    note: SCuBA requires a managed device; we also accept MFA or a Temporary Access Pass.
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: IA-5
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: IA-2(2)
    relation: related
threats:
  - framework: mitre-attack
    id: T1098.005
  - framework: mitre-attack
    id: T1556.006
related_controls:
  - id: CB-M365-AUTH-017
    type: related
  - id: CB-M365-AUTH-018
    type: related
  - id: CB-M365-AUTH-020
    type: related
  - id: CB-M365-AUTH-032
    type: related
  - id: CB-M365-AUTH-041
    type: related
  - id: CB-M365-ADMIN-002
    type: related
  - id: CB-M365-AUTH-028
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24