Require a fresh sign-in with MFA for every Intune device enrollment

Description

A Conditional Access policy targets the Microsoft Intune Enrollment resource for all users, requires multifactor authentication (or an authentication strength) and sets the session control Sign-in frequency to Every time. Each enrollment then needs a new interactive sign-in with MFA, whatever session the user already holds.

The Microsoft Intune Enrollment resource is not created automatically in new tenants. If it is missing from the resource picker, create its service principal (application ID d4ebce55-015a-49b5-a083-c84d1797ae8c) with New-MgServicePrincipal -AppId d4ebce55-015a-49b5-a083-c84d1797ae8c. Selecting Microsoft Intune instead also prompts at every Company Portal sign-in.

Rationale

An enrolled device becomes a trusted object: it can be marked compliant, receive certificates and Wi-Fi or VPN profiles, and satisfy device-based Conditional Access (CB-M365-AUTH-020). Attackers who stole a session use device enrollment to persist and to bypass those policies. A fresh MFA at enrollment means a stolen token alone is not enough.

Impact

Users complete one MFA prompt during each enrollment. Corporate devices enrolled through Apple automated device enrollment or Android Enterprise fully managed need a second device or a Temporary Access Pass to answer the prompt. Do not add device-based grant controls to this policy, or enrollment of new devices fails.

Applies when

Requires: Microsoft Entra ID P1, Microsoft Intune

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Security Reader.
2. Browse to Entra ID > Conditional Access > Policies.
3. Find a policy with State set to On where:
   • Users > Include is All users (emergency access accounts may be excluded);
   • Target resources includes Microsoft Intune Enrollment (or All resources);
   • Grant requires multifactor authentication or an authentication strength;
   • Session > Sign-in frequency is set to Every time.
4. Alternative in PowerShell (Microsoft Graph, scope Policy.Read.All): Get-MgIdentityConditionalAccessPolicy | Where-Object { $_.SessionControls.SignInFrequency.FrequencyInterval -eq 'everyTime' } | Select-Object DisplayName, State, @{n='Apps';e={$_.Conditions.Applications.IncludeApplications}} and look for application ID d4ebce55-015a-49b5-a083-c84d1797ae8c.
5. Fail if no enabled policy combines the enrollment resource, MFA and Every time.

Remediation

1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator (the same screens are available in the Intune admin center under Devices > Conditional Access).
2. Browse to Entra ID > Conditional Access > Policies and select New policy.
3. Name it, for example ALL - Intune enrollment - MFA every time.
4. Users > Include: All users. Exclude: the emergency access accounts.
5. Target resources > Resources > Select resources: Microsoft Intune Enrollment.
6. Grant > Grant access > Require multifactor authentication (or Require authentication strength).
7. Session > Sign-in frequency > Every time.
8. Set Enable policy to Report-only, check enrollments in the sign-in logs, then switch to On.

Rollback

Set the policy to Report-only or Off.

References

• Require multifactor authentication for Intune device enrollment Microsoft, vendor-doc, accessed 2026-10-24
• Conditional Access adaptive session lifetime - Require reauthentication every time Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-AUTH-025 Require users to sign in again at least every {{ user_signin_frequency_days }} days
• related CB-M365-AUTH-020 Require a compliant or hybrid joined device to access resources
• related CB-M365-AUTH-019 Protect security information registration with a managed device or MFA

People and lifecycle