Block authentication transfer

Description

A Conditional Access policy for All users on All resources blocks the Authentication transfer authentication flow. Authentication transfer lets a user signed in to a desktop application, such as Outlook, sign in to the mobile app by scanning a QR code, without authenticating again on the phone.

The policy excludes only the emergency access accounts.

Rationale

Transfer carries the desktop authentication to another device without a fresh sign-in there, so that device never proves it meets the device or MFA requirements on its own. An attacker with temporary access to an unlocked computer can use it to get a durable session on their own phone.

Impact

Users must sign in on the mobile app normally. The convenience QR code in Outlook for Windows and Mac no longer works.

Applies when

Requires: Microsoft Entra ID P1

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Security Reader.
2. Browse to Entra ID > Conditional Access > Policies.
3. Find a policy with State set to On where Users includes All users (only emergency access accounts excluded), Target resources includes All resources, Conditions > Authentication flows selects Authentication transfer, and Grant is Block access.
4. Read-only alternative with Microsoft Graph PowerShell (scope Policy.Read.All): Get-MgIdentityConditionalAccessPolicy | Where-Object { $_.Conditions.AuthenticationFlows.TransferMethods -match 'authenticationTransfer' } | Select-Object DisplayName, State, @{n='Grant';e={$_.GrantControls.BuiltInControls}}
5. Fail if no such policy exists, or if it is Report-only or Off.

Remediation

1. As at least a Conditional Access Administrator, browse to Entra ID > Conditional Access > Policies and select New policy. A single policy can block both device code flow and authentication transfer.
2. Name it, for example ALL - Block authentication transfer.
3. Users > Include: All users. Exclude: the emergency access accounts.
4. Target resources > Resources > Include: All resources.
5. Conditions > Authentication flows: Configure Yes, select Authentication transfer.
6. Grant: Block access.
7. Set Enable policy to Report-only, review, then switch to On. Graph equivalent: New-MgIdentityConditionalAccessPolicy with conditions.authenticationFlows.transferMethods set to authenticationTransfer and grantControls.builtInControls set to block.

Rollback

Set the policy to Report-only or Off.

References

• Block authentication flows with Conditional Access policy Microsoft, vendor-doc, accessed 2026-10-24
• Conditional Access authentication transfer Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-AUTH-022 Block device code flow
• related CB-M365-ADMIN-002 Keep two protected emergency access accounts

People and lifecycle