{
  "id": "CB-M365-AUTH-028",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-028",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-028.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-028.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-028",
    "title": "Require a fresh sign-in with MFA for every Intune device enrollment",
    "finding": {
      "title": "Devices can be enrolled in Intune with an existing session, without a fresh sign-in",
      "description": "An attacker holding a user's session or refresh token can enroll a device of their own and make it look managed to Conditional Access."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "intune",
      "enrollment",
      "conditional-access",
      "mfa",
      "sign-in-frequency",
      "devices"
    ],
    "applicability": {
      "requires": [
        "Microsoft Entra ID P1",
        "Microsoft Intune"
      ]
    },
    "description": "A Conditional Access policy targets the **Microsoft Intune Enrollment** resource for all users,\nrequires multifactor authentication (or an authentication strength) and sets the session control\n**Sign-in frequency** to **Every time**. Each enrollment then needs a new interactive sign-in with\nMFA, whatever session the user already holds.\n",
    "rationale": "An enrolled device becomes a trusted object: it can be marked compliant, receive certificates and\nWi-Fi or VPN profiles, and satisfy device-based Conditional Access (CB-M365-AUTH-020). Attackers\nwho stole a session use device enrollment to persist and to bypass those policies. A fresh MFA at\nenrollment means a stolen token alone is not enough.\n",
    "impact": "Users complete one MFA prompt during each enrollment. Corporate devices enrolled through Apple\nautomated device enrollment or Android Enterprise fully managed need a second device or a\nTemporary Access Pass to answer the prompt. Do not add device-based grant controls to this\npolicy, or enrollment of new devices fails.\n",
    "notes": "The **Microsoft Intune Enrollment** resource is not created automatically in new tenants. If it is\nmissing from the resource picker, create its service principal (application ID\n`d4ebce55-015a-49b5-a083-c84d1797ae8c`) with `New-MgServicePrincipal -AppId d4ebce55-015a-49b5-a083-c84d1797ae8c`.\nSelecting **Microsoft Intune** instead also prompts at every Company Portal sign-in.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Security Reader.\n2. Browse to **Entra ID** > **Conditional Access** > **Policies**.\n3. Find a policy with **State** set to **On** where:\n   - **Users** > **Include** is **All users** (emergency access accounts may be excluded);\n   - **Target resources** includes **Microsoft Intune Enrollment** (or **All resources**);\n   - **Grant** requires multifactor authentication or an authentication strength;\n   - **Session** > **Sign-in frequency** is set to **Every time**.\n4. Alternative in PowerShell (Microsoft Graph, scope `Policy.Read.All`):\n   `Get-MgIdentityConditionalAccessPolicy | Where-Object { $_.SessionControls.SignInFrequency.FrequencyInterval -eq 'everyTime' } | Select-Object DisplayName, State, @{n='Apps';e={$_.Conditions.Applications.IncludeApplications}}`\n   and look for application ID `d4ebce55-015a-49b5-a083-c84d1797ae8c`.\n5. Fail if no enabled policy combines the enrollment resource, MFA and **Every time**.\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator\n   (the same screens are available in the Intune admin center under **Devices** >\n   **Conditional Access**).\n2. Browse to **Entra ID** > **Conditional Access** > **Policies** and select **New policy**.\n3. Name it, for example `ALL - Intune enrollment - MFA every time`.\n4. **Users** > **Include**: **All users**. **Exclude**: the emergency access accounts.\n5. **Target resources** > **Resources** > **Select resources**: **Microsoft Intune Enrollment**.\n6. **Grant** > **Grant access** > **Require multifactor authentication** (or **Require\n   authentication strength**).\n7. **Session** > **Sign-in frequency** > **Every time**.\n8. Set **Enable policy** to **Report-only**, check enrollments in the sign-in logs, then switch\n   to **On**.\n",
      "rollback": "Set the policy to **Report-only** or **Off**.\n"
    },
    "references": [
      {
        "title": "Require multifactor authentication for Intune device enrollment",
        "url": "https://learn.microsoft.com/intune/device-enrollment/configure-multifactor-authentication",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Conditional Access adaptive session lifetime - Require reauthentication every time",
        "url": "https://learn.microsoft.com/entra/identity/conditional-access/concept-session-lifetime",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-11",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-2(1)",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1098.005"
      },
      {
        "framework": "mitre-attack",
        "id": "T1550.001"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-025",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-020",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-019",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}