{
  "id": "CB-M365-DEVICE-009",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-009",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-009.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-009.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-DEVICE-009",
    "title": "Require MFA to register or join devices through Conditional Access",
    "finding": {
      "title": "Devices can be registered or joined without multifactor authentication",
      "description": "A stolen password is enough to register or join a device and obtain a device identity and Primary Refresh Token in the tenant."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "entra-id",
      "conditional-access",
      "mfa",
      "device-registration",
      "device-join"
    ],
    "applicability": {
      "requires": [
        "Microsoft Entra ID P1"
      ]
    },
    "description": "A Conditional Access policy targets the user action **Register or join devices**, for all users\nexcept the emergency access accounts, and grants access only with the built-in **Multifactor\nauthentication** authentication strength (or a stronger one).\n\nThe legacy device setting **Require Multifactor Authentication to register or join devices with\nMicrosoft Entra** is set to **No**, as Microsoft requires: when that toggle is **Yes**, Conditional\nAccess policies using the **Register or join devices** user action are not enforced properly.\n",
    "rationale": "Registering a device is a classic persistence step after a password spray or phishing: the\nattacker obtains a device object and a Primary Refresh Token that survive a password reset and\ncan satisfy device-based Conditional Access conditions. Requiring MFA at that moment, through\nConditional Access, blocks the step for password-only attackers and lets the organization choose\nthe authentication strength and exclusions instead of the all-or-nothing device setting.\n",
    "impact": "Users must complete MFA when they register a mobile device, add a work account on Windows or join\na computer. Users without a registered MFA method cannot register devices until they enroll one.\nAutopilot self-deploying and pre-provisioning flows do not involve a user and are not affected.\n",
    "notes": "The **Register or join devices** user action supports only the grant controls **Require\nmultifactor authentication** and **Require authentication strength**; device-based conditions\ncannot be used in this policy. External authentication methods are not compatible with\nauthentication strengths: use **Require multifactor authentication** in that case.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Security Reader.\n2. Browse to **Entra ID** > **Conditional Access** > **Policies** and find a policy in state\n   **On** where:\n   - **Users** > **Include** is **All users**, and **Exclude** contains only the emergency\n     access accounts;\n   - **Target resources** is **User actions** > **Register or join devices**;\n   - **Grant** is **Require authentication strength** (**Multifactor authentication** or\n     stronger) or **Require multifactor authentication**.\n3. Browse to **Entra ID** > **Devices** > **Device settings** and check that **Require\n   Multifactor Authentication to register or join devices with Microsoft Entra** is **No**.\n4. Alternative, read only: `Invoke-MgGraphRequest -Method GET -Uri\n   https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies` (scope\n   `Policy.Read.All`) and look for `conditions.applications.includeUserActions` containing\n   `urn:user:registerdevice`; read `multiFactorAuthConfiguration` in\n   `GET https://graph.microsoft.com/beta/policies/deviceRegistrationPolicy` (must be\n   `notRequired`).\n5. Fail if no enabled policy exists, or if the device setting is **Yes** (the two conflict).\n"
    },
    "remediation": {
      "manual": "1. Browse to **Entra ID** > **Conditional Access** > **Policies** > **New policy**. Role:\n   Conditional Access Administrator.\n2. Name it, for example `DEV - Require MFA to register or join devices`.\n3. **Users** > **Include**: **All users**. **Exclude**: the emergency access accounts.\n4. **Target resources** > **User actions** > **Register or join devices**.\n5. **Grant** > **Grant access** > **Require authentication strength** > **Multifactor\n   authentication**.\n6. Set **Enable policy** to **Report-only**, save, and review the sign-in logs for device\n   registration events for a few days.\n7. Browse to **Entra ID** > **Devices** > **Device settings**, set **Require Multifactor\n   Authentication to register or join devices with Microsoft Entra** to **No** (role: Cloud\n   Device Administrator), then switch the policy to **On**.\n",
      "rollback": "Set the Conditional Access policy to **Report-only** or **Off**. Do not switch the device\nsetting back to **Yes** while any policy targets the user action.\n"
    },
    "references": [
      {
        "title": "Require multifactor authentication for device registration",
        "url": "https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-device-registration",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Manage devices in Microsoft Entra ID - Configure device settings",
        "url": "https://learn.microsoft.com/entra/identity/devices/manage-device-identities",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Maester test MT.1061",
        "url": "https://maester.dev/docs/tests/MT.1061",
        "publisher": "Maester",
        "kind": "tool",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-2(1)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-3",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1098.005"
      },
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-DEVICE-003",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-003",
        "type": "related"
      },
      {
        "id": "CB-M365-ADMIN-002",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}