# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-AUTH-023
title: Block authentication transfer
finding:
  title: Authentication transfer is allowed
  description: Users can move a signed-in session from a computer to a mobile device by scanning a QR code, which brings the session to devices that may not be managed.
status: active
profiles: [baseline]
risk:
  severity: medium
assessment: manual
tags: [conditional-access, authentication-transfer, authentication-flows]

applicability:
  requires:
    - "Microsoft Entra ID P1"

description: |
  A Conditional Access policy for **All users** on **All resources** blocks the **Authentication
  transfer** authentication flow. Authentication transfer lets a user signed in to a desktop
  application, such as Outlook, sign in to the mobile app by scanning a QR code, without
  authenticating again on the phone.

  The policy excludes only the emergency access accounts.
rationale: |
  Transfer carries the desktop authentication to another device without a fresh sign-in there, so
  that device never proves it meets the device or MFA requirements on its own. An attacker with
  temporary access to an unlocked computer can use it to get a durable session on their own
  phone.
impact: |
  Users must sign in on the mobile app normally. The convenience QR code in Outlook for Windows
  and Mac no longer works.

audit:
  manual: |
    1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a
       Security Reader.
    2. Browse to **Entra ID** > **Conditional Access** > **Policies**.
    3. Find a policy with **State** set to **On** where **Users** includes **All users** (only
       emergency access accounts excluded), **Target resources** includes **All resources**,
       **Conditions** > **Authentication flows** selects **Authentication transfer**, and
       **Grant** is **Block access**.
    4. Read-only alternative with Microsoft Graph PowerShell (scope `Policy.Read.All`):
       `Get-MgIdentityConditionalAccessPolicy | Where-Object { $_.Conditions.AuthenticationFlows.TransferMethods -match 'authenticationTransfer' } | Select-Object DisplayName, State, @{n='Grant';e={$_.GrantControls.BuiltInControls}}`
    5. Fail if no such policy exists, or if it is Report-only or Off.

remediation:
  manual: |
    1. As at least a Conditional Access Administrator, browse to **Entra ID** >
       **Conditional Access** > **Policies** and select **New policy**. A single policy can block
       both device code flow and authentication transfer.
    2. Name it, for example `ALL - Block authentication transfer`.
    3. **Users** > **Include**: **All users**. **Exclude**: the emergency access accounts.
    4. **Target resources** > **Resources** > **Include**: **All resources**.
    5. **Conditions** > **Authentication flows**: **Configure** **Yes**, select **Authentication
       transfer**.
    6. **Grant**: **Block access**.
    7. Set **Enable policy** to **Report-only**, review, then switch to **On**.
    Graph equivalent: `New-MgIdentityConditionalAccessPolicy` with
    `conditions.authenticationFlows.transferMethods` set to `authenticationTransfer` and
    `grantControls.builtInControls` set to `block`.
  rollback: |
    Set the policy to **Report-only** or **Off**.

references:
  - title: Block authentication flows with Conditional Access policy
    url: https://learn.microsoft.com/entra/identity/conditional-access/policy-block-authentication-flows
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Conditional Access authentication transfer
    url: https://learn.microsoft.com/entra/identity/conditional-access/concept-authentication-transfer
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
mappings:
  - framework: cis-m365
    framework_version: "7.0.0"
    id: "5.2.2.17"
    relation: equivalent
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: CM-7
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-19
    relation: related
threats:
  - framework: mitre-attack
    id: T1550.001
related_controls:
  - id: CB-M365-AUTH-022
    type: related
  - id: CB-M365-ADMIN-002
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24