Conditional Access requires a managed device to sign in

Check ID: entra_managed_device_required_for_authentication
Provider: Microsoft 365
Service: entra
Severity: HIGH
Categories: identity-access, e3
Resource type: NotDefined

What this check verifies

Microsoft Entra Conditional Access evaluates whether an enabled policy targeting all users and all applications includes grant controls that require a managed device (hybrid domain-joined) with multifactor authentication during sign-in.

Risk

Sign-ins from unmanaged devices erode confidentiality and integrity: compromised hosts can steal tokens, hijack sessions, and exfiltrate data. With leaked credentials, attackers bypass endpoint controls, gain persistent access, and move laterally to alter resources.

Recommendation

Enforce Conditional Access to allow only managed devices (Entra hybrid joined or Intune-compliant) and require MFA, aligning with Zero Trust and least privilege. Apply to all users and apps, limit exclusions to break-glass accounts, and regularly review device compliance to prevent access from unknown endpoints.

Remediation

CLI
Terraform
Dashboard steps

New-MgIdentityConditionalAccessPolicy -DisplayName "<example_resource_name>" -State "enabled" -Conditions @{ Users=@{ IncludeUsers=@("All") }; Applications=@{ IncludeApplications=@("All") } } -GrantControls @{ Operator="OR"; BuiltInControls=@("mfa","domainJoinedDevice") }

resource "azuread_conditional_access_policy" "example" {
  display_name = "<example_resource_name>"
  state        = "enabled" # Critical: must be enabled (not report-only) to enforce

  conditions {
    users {
      include_users = ["All"] # Critical: target all users
    }
    applications {
      include_applications = ["All"] # Critical: target all cloud apps
    }
  }

  grant_controls {
    operator          = "OR" # Critical: require one of the selected controls
    built_in_controls = ["mfa", "domainJoinedDevice"] # Critical: MFA or Microsoft Entra hybrid joined device
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_managed_device_required_for_authentication. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Microsoft 365 checks

Conditional Access blocks legacy authentication MFA registration requires a managed device

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires