Conditional Access enforces MFA for guest users

​

What this check verifies

Microsoft Entra Conditional Access is verified to have at least one enabled policy that requires multifactor authentication for all guest and external user types across all cloud applications. This includes internal guests, B2B collaboration guests and members, B2B direct connect users, other external users, and service providers.

​

Risk

Without MFA for guest users, compromised external accounts can access tenant resources using only a password. Attackers may exploit B2B collaboration, direct connect, or service provider accounts to exfiltrate data, escalate privileges, or move laterally across the organization.

​

Recommendation

Enforce MFA via Conditional Access for all guest and external user types across all cloud applications. Prefer phishing-resistant methods, monitor guest sign-ins, and regularly review external collaboration settings.

​

Remediation

Dashboard steps

1. Navigate to the Microsoft Entra admin center (https://entra.microsoft.com).
2. Expand Protection > Conditional Access and select Policies.
3. Click New policy.
4. Under Users, select Include > Select users and groups > check Guest or external users > select all guest user types.
5. Under Target resources, select Include > All cloud apps.
6. Under Grant, select Grant access > check Require multifactor authentication > click Select.
7. Set the policy to Report-only until validated, then enable it.

​

References

• https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-alt-require-mfa-guest-access

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_conditional_access_policy_mfa_enforced_for_guest_users. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks