{
  "id": "CB-M365-AUTH-023",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-023",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-023.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-023.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-023",
    "title": "Block authentication transfer",
    "finding": {
      "title": "Authentication transfer is allowed",
      "description": "Users can move a signed-in session from a computer to a mobile device by scanning a QR code, which brings the session to devices that may not be managed."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "conditional-access",
      "authentication-transfer",
      "authentication-flows"
    ],
    "applicability": {
      "requires": [
        "Microsoft Entra ID P1"
      ]
    },
    "description": "A Conditional Access policy for **All users** on **All resources** blocks the **Authentication\ntransfer** authentication flow. Authentication transfer lets a user signed in to a desktop\napplication, such as Outlook, sign in to the mobile app by scanning a QR code, without\nauthenticating again on the phone.\n\nThe policy excludes only the emergency access accounts.\n",
    "rationale": "Transfer carries the desktop authentication to another device without a fresh sign-in there, so\nthat device never proves it meets the device or MFA requirements on its own. An attacker with\ntemporary access to an unlocked computer can use it to get a durable session on their own\nphone.\n",
    "impact": "Users must sign in on the mobile app normally. The convenience QR code in Outlook for Windows\nand Mac no longer works.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Security Reader.\n2. Browse to **Entra ID** > **Conditional Access** > **Policies**.\n3. Find a policy with **State** set to **On** where **Users** includes **All users** (only\n   emergency access accounts excluded), **Target resources** includes **All resources**,\n   **Conditions** > **Authentication flows** selects **Authentication transfer**, and\n   **Grant** is **Block access**.\n4. Read-only alternative with Microsoft Graph PowerShell (scope `Policy.Read.All`):\n   `Get-MgIdentityConditionalAccessPolicy | Where-Object { $_.Conditions.AuthenticationFlows.TransferMethods -match 'authenticationTransfer' } | Select-Object DisplayName, State, @{n='Grant';e={$_.GrantControls.BuiltInControls}}`\n5. Fail if no such policy exists, or if it is Report-only or Off.\n"
    },
    "remediation": {
      "manual": "1. As at least a Conditional Access Administrator, browse to **Entra ID** >\n   **Conditional Access** > **Policies** and select **New policy**. A single policy can block\n   both device code flow and authentication transfer.\n2. Name it, for example `ALL - Block authentication transfer`.\n3. **Users** > **Include**: **All users**. **Exclude**: the emergency access accounts.\n4. **Target resources** > **Resources** > **Include**: **All resources**.\n5. **Conditions** > **Authentication flows**: **Configure** **Yes**, select **Authentication\n   transfer**.\n6. **Grant**: **Block access**.\n7. Set **Enable policy** to **Report-only**, review, then switch to **On**.\nGraph equivalent: `New-MgIdentityConditionalAccessPolicy` with\n`conditions.authenticationFlows.transferMethods` set to `authenticationTransfer` and\n`grantControls.builtInControls` set to `block`.\n",
      "rollback": "Set the policy to **Report-only** or **Off**.\n"
    },
    "references": [
      {
        "title": "Block authentication flows with Conditional Access policy",
        "url": "https://learn.microsoft.com/entra/identity/conditional-access/policy-block-authentication-flows",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Conditional Access authentication transfer",
        "url": "https://learn.microsoft.com/entra/identity/conditional-access/concept-authentication-transfer",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-19",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1550.001"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-022",
        "type": "related"
      },
      {
        "id": "CB-M365-ADMIN-002",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}