{
  "id": "CB-M365-AUTH-021",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-021",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-021.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-021.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-021",
    "title": "Block unknown or unsupported device platforms",
    "finding": {
      "title": "Sign-ins from unknown device platforms are allowed",
      "description": "Requests whose user agent matches no supported platform, typical of scripts, attack tools and unusual operating systems, are not blocked."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "conditional-access",
      "device-platforms",
      "managed-device"
    ],
    "applicability": {
      "requires": [
        "Microsoft Entra ID P1"
      ]
    },
    "description": "A Conditional Access policy for **All users** on **All resources** blocks access from **Any\ndevice**, excluding only the platforms the organisation supports: `{{ allowed_device_platforms }}`.\nLinux, Windows Phone and unknown platforms are then refused unless explicitly allowed.\n\nThe policy excludes only the emergency access accounts.\n",
    "parameters": [
      {
        "name": "allowed_device_platforms",
        "type": "list",
        "description": "Device platforms excluded from the block, as named in Conditional Access.",
        "default": [
          "android",
          "iOS",
          "windows",
          "macOS"
        ],
        "allowed": [
          "android",
          "iOS",
          "windows",
          "macOS",
          "linux",
          "windowsPhone"
        ]
      }
    ],
    "rationale": "Many token theft and password spray tools present user agents that match no supported platform.\nBlocking them reduces the attack surface and keeps device-based policies from being sidestepped\nthrough a platform they do not evaluate.\n",
    "impact": "Users on a platform that is not listed, for example Linux workstations, are blocked: add it to\nthe parameter if it is supported. The platform condition relies on the user agent, which an\nattacker can forge: this control complements CB-M365-AUTH-020, it does not replace it.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Security Reader.\n2. Browse to **Entra ID** > **Conditional Access** > **Policies**.\n3. Find a policy with **State** set to **On** where **Users** includes **All users** (only\n   emergency access accounts excluded), **Target resources** includes **All resources**,\n   **Conditions** > **Device platforms** includes **Any device** and excludes exactly\n   `{{ allowed_device_platforms }}`, and **Grant** is **Block access**.\n4. Read-only alternative with Microsoft Graph PowerShell (scope `Policy.Read.All`):\n   `Get-MgIdentityConditionalAccessPolicy | Where-Object { $_.Conditions.Platforms.IncludePlatforms -contains 'all' } | Select-Object DisplayName, State, @{n='Excluded';e={$_.Conditions.Platforms.ExcludePlatforms}}, @{n='Grant';e={$_.GrantControls.BuiltInControls}}`\n5. Fail if no such policy exists, if it is Report-only or Off, or if it excludes a platform\n   that is not in the list.\n"
    },
    "remediation": {
      "manual": "1. As at least a Conditional Access Administrator, browse to **Entra ID** >\n   **Conditional Access** > **Policies** and select **New policy**.\n2. Name it, for example `ALL - Block unknown platforms`.\n3. **Users** > **Include**: **All users**. **Exclude**: the emergency access accounts.\n4. **Target resources** > **Resources** > **Include**: **All resources**.\n5. **Conditions** > **Device platforms**: **Configure** **Yes**, **Include** **Any device**,\n   **Exclude** the platforms in `{{ allowed_device_platforms }}`.\n6. **Grant**: **Block access**.\n7. Set **Enable policy** to **Report-only**, review the sign-in logs for blocked platforms,\n   then switch to **On**.\nGraph equivalent: `New-MgIdentityConditionalAccessPolicy` with\n`conditions.platforms.includePlatforms` set to `all`, `excludePlatforms` set to the list and\n`grantControls.builtInControls` set to `block`.\n",
      "rollback": "Set the policy to **Report-only**, or add the missing platform to the exclusions.\n"
    },
    "references": [
      {
        "title": "Block access for unknown or unsupported device platform",
        "url": "https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-device-unknown-unsupported",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-19",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-020",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-029",
        "type": "related"
      },
      {
        "id": "CB-M365-ADMIN-002",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}