Conditional Access requires a compliant device or MFA

​

What this check verifies

Microsoft Entra Conditional Access policy enforces one of the following grant controls for admin roles or all users across all cloud apps: - ‘Require device to be marked as compliant’ - ‘Require Microsoft Entra hybrid joined device’ - ‘Require multifactor authentication’ This ensures that access is provided only under strong authentication or trusted device conditions.

​

Risk

If this policy is not implemented, attackers with compromised credentials may gain access from unmanaged devices or without strong authentication, increasing the likelihood of unauthorized access and data breaches.

​

Recommendation

Enforce a Conditional Access baseline where admins or all users must satisfy at least one strong control: compliant device, hybrid joined device, or MFA.

​

Remediation

Dashboard steps

1. Navigate to Microsoft Entra admin center https://entra.microsoft.com.
2. Go to Protection > Conditional Access > Policies and create or edit a policy.
3. Under Users, include All users or administrative roles.
4. Under Target resources, include All cloud apps.
5. Under Grant, select Grant access and enable these controls: Require multifactor authentication, Require device to be marked as compliant, and Require Microsoft Entra hybrid joined device.
6. Set Grant operator to Require one of the selected controls.
7. Start in Report-only mode for validation and then switch to On.

​

References

• https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-grant
• https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-policy-compliant-device

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_conditional_access_policy_compliant_device_hybrid_joined_device_mfa_required. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks