Conditional Access requires phishing-resistant admin MFA

​

What this check verifies

Microsoft Entra Conditional Access for administrator roles requires phishing-resistant MFA authentication strength on All applications. Disabled policies are ignored; report-only policies aren’t considered. Policies with custom strengths require review to confirm they are truly phishing-resistant.

​

Risk

Without phishing-resistant MFA on admin accounts, attackers can:

• Bypass OTP/push via AiTM phishing
• Abuse MFA fatigue to gain sessions
• Perform tenant takeover, alter policies, and exfiltrate data

This harms confidentiality, configuration integrity, and service availability.

​

Recommendation

Require Phishing-resistant MFA via Conditional Access for all privileged roles and All resources. Favor FIDO2, Windows Hello for Business, or certificate-based auth. Apply least privilege, use PIM for step-up on role activation, test in report-only, and keep a monitored break-glass account.

​

Remediation

Dashboard steps

1. Sign in to Microsoft Entra admin center (https://entra.microsoft.com)
2. Go to Entra ID > Conditional Access > Policies > New policy
3. Users > Include > Directory roles > select Global Administrator (or the admin roles you require)
4. Target resources > Resources (cloud apps) > Include > All cloud apps; ensure Exclude is empty
5. Grant > Grant access > Require authentication strength > select Phishing-resistant MFA > Select
6. Enable policy: On
7. Click Create

​

References

• https://blog.admindroid.com/use-phishing-resistant-mfa-to-implement-stronger-mfa-authentication/
• https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-admin-phish-resistant-mfa#create-a-conditional-access-policy
• https://docs.azure.cn/en-us/entra/identity/conditional-access/policy-guests-mfa-strength
• https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-admin-phish-resistant-mfa

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_admin_users_phishing_resistant_mfa_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks