Require MFA to register or join devices through Conditional Access

Description

A Conditional Access policy targets the user action Register or join devices, for all users except the emergency access accounts, and grants access only with the built-in Multifactor authentication authentication strength (or a stronger one).

The legacy device setting Require Multifactor Authentication to register or join devices with Microsoft Entra is set to No, as Microsoft requires: when that toggle is Yes, Conditional Access policies using the Register or join devices user action are not enforced properly.

The Register or join devices user action supports only the grant controls Require multifactor authentication and Require authentication strength; device-based conditions cannot be used in this policy. External authentication methods are not compatible with authentication strengths: use Require multifactor authentication in that case.

Rationale

Registering a device is a classic persistence step after a password spray or phishing: the attacker obtains a device object and a Primary Refresh Token that survive a password reset and can satisfy device-based Conditional Access conditions. Requiring MFA at that moment, through Conditional Access, blocks the step for password-only attackers and lets the organization choose the authentication strength and exclusions instead of the all-or-nothing device setting.

Impact

Users must complete MFA when they register a mobile device, add a work account on Windows or join a computer. Users without a registered MFA method cannot register devices until they enroll one. Autopilot self-deploying and pre-provisioning flows do not involve a user and are not affected.

Applies when

Requires: Microsoft Entra ID P1

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Security Reader.
2. Browse to Entra ID > Conditional Access > Policies and find a policy in state On where:
   • Users > Include is All users, and Exclude contains only the emergency access accounts;
   • Target resources is User actions > Register or join devices;
   • Grant is Require authentication strength (Multifactor authentication or stronger) or Require multifactor authentication.
3. Browse to Entra ID > Devices > Device settings and check that Require Multifactor Authentication to register or join devices with Microsoft Entra is No.
4. Alternative, read only: Invoke-MgGraphRequest -Method GET -Uri https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies (scope Policy.Read.All) and look for conditions.applications.includeUserActions containing urn:user:registerdevice; read multiFactorAuthConfiguration in GET https://graph.microsoft.com/beta/policies/deviceRegistrationPolicy (must be notRequired).
5. Fail if no enabled policy exists, or if the device setting is Yes (the two conflict).

Remediation

1. Browse to Entra ID > Conditional Access > Policies > New policy. Role: Conditional Access Administrator.
2. Name it, for example DEV - Require MFA to register or join devices.
3. Users > Include: All users. Exclude: the emergency access accounts.
4. Target resources > User actions > Register or join devices.
5. Grant > Grant access > Require authentication strength > Multifactor authentication.
6. Set Enable policy to Report-only, save, and review the sign-in logs for device registration events for a few days.
7. Browse to Entra ID > Devices > Device settings, set Require Multifactor Authentication to register or join devices with Microsoft Entra to No (role: Cloud Device Administrator), then switch the policy to On.

Rollback

Set the Conditional Access policy to Report-only or Off. Do not switch the device setting back to Yes while any policy targets the user action.

References

• Require multifactor authentication for device registration Microsoft, vendor-doc, accessed 2026-10-24
• Manage devices in Microsoft Entra ID - Configure device settings Microsoft, vendor-doc, accessed 2026-10-24
• Maester test MT.1061 Maester, tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-DEVICE-003 Restrict who can join devices to Microsoft Entra ID
• related CB-M365-AUTH-003 Require MFA for all users on all resources
• related CB-M365-ADMIN-002 Keep two protected emergency access accounts

People and lifecycle