Intune enrollment requires MFA every time

Check ID: entra_intune_enrollment_sign_in_frequency_every_time
Provider: Microsoft 365
Service: entra
Severity: HIGH
Categories: identity-access, e3
Resource type: NotDefined

What this check verifies

Microsoft Entra Conditional Access for Microsoft Intune Enrollment must require strong authentication and set sign-in frequency to Every time for all users. This check evaluates whether an active policy targets the Intune Enrollment app, requires MFA or authentication strength, and forces reauthentication on each enrollment attempt.

Risk

Absent strong authentication and Every time reauthentication at enrollment, attackers with stolen or replayed credentials can enroll rogue devices and obtain compliant access. Impacts:

Confidentiality: data exposure from unauthorized devices
Integrity: untrusted endpoints modifying resources
Availability: persistence via device-based access paths

Recommendation

Implement a Conditional Access policy on the Intune Enrollment app that requires MFA or authentication strength and sets sign-in frequency to Every time. Microsoft Entra requires this grant control when Every time is configured for Intune Enrollment, so TigerGate validates both conditions together in a single check.

Remediation

CLI
Terraform
Dashboard steps

az rest --method POST --url https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies --headers 'Content-Type=application/json' --body '{"displayName":"Intune Enrollment - MFA and Every time","state":"enabled","conditions":{"users":{"includeUsers":["All"]},"applications":{"includeApplications":["d4ebce55-015a-49b5-a083-c84d1797ae8c"]}},"grantControls":{"operator":"OR","builtInControls":["mfa"]},"sessionControls":{"signInFrequency":{"isEnabled":true,"type":"everyTime"}}}'

resource "azuread_conditional_access_policy" "<example_resource_name>" {
  display_name = "<example_resource_name>"
  state        = "enabled"

  conditions {
    users {
      include_users = ["All"] # critical: include all users
    }
    applications {
      include_applications = ["d4ebce55-015a-49b5-a083-c84d1797ae8c"] # critical: target Microsoft Intune Enrollment app
    }
  }

  session_controls {
    sign_in_frequency {
      is_enabled = true      # critical: enable sign-in frequency control
      type       = "everyTime" # critical: require reauthentication every time
    }
  }
}

Sign in to Microsoft Entra admin center (entra.microsoft.com)
Go to Protection > Conditional Access > Policies > New policy
Users > Include: select All users
Target resources (Resources/Cloud apps) > Select resources: choose Microsoft Intune Enrollment (App ID: d4ebce55-015a-49b5-a083-c84d1797ae8c)
Grant > Grant access: select either Require multifactor authentication or Require authentication strength
Session > Sign-in frequency: select Every time
Enable policy: On
Create the policy

References

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_intune_enrollment_sign_in_frequency_every_time. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Microsoft 365 checks

Identity Protection user risk policy is enabled Conditional Access blocks legacy authentication

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires