Conditional Access enforces MFA for device registration

​

What this check verifies

Microsoft Entra Conditional Access policies can require multifactor authentication (MFA) for device registration operations. This control ensures users must complete MFA before registering or joining devices to the directory, reducing the likelihood that compromised credentials can be used to register rogue devices.

​

Risk

Without MFA for device registration, attackers with stolen credentials could register unauthorized devices into the directory, gain persistence, and bypass compliance-based Conditional Access protections that rely on trusted device state.

​

Recommendation

Enforce MFA through Conditional Access for device registration so users must verify identity before registering or joining devices to the directory.

​

Remediation

Dashboard steps

1. Navigate to the Microsoft Entra admin center (https://entra.microsoft.com).
2. Expand Protection > Conditional Access and select Policies.
3. Click New policy.
4. Under Users, include All users.
5. Under Target resources, select User actions and check Register or join devices.
6. Under Grant, select Grant access and require multifactor authentication.
7. Set the policy to Report-only until validated, then enable it.

​

References

• https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-all-users-device-registration
• https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-cloud-apps#user-actions

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_conditional_access_policy_device_registration_mfa_required. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks