MFA registration requires a managed device

Check ID: entra_managed_device_required_for_mfa_registration
Provider: Microsoft 365
Service: entra
Severity: HIGH
Categories: identity-access, e3
Resource type: NotDefined

What this check verifies

Microsoft Entra Conditional Access evaluates whether MFA registration is restricted to organization-managed devices. It looks for policies that target the security info registration action for all users and require a managed (compliant or hybrid-joined) device when registering authentication methods.

Risk

Allowing MFA enrollment from unmanaged or compromised devices enables attackers with stolen passwords to add their own factors, causing account takeover and potential lockout of the legitimate user. This jeopardizes confidentiality (data access), integrity (unauthorized changes), and availability (user access disruption).

Recommendation

Enforce MFA registration only from managed devices using Conditional Access. Apply the policy broadly, with minimal exclusions for break-glass accounts. Align with Zero Trust and least privilege by requiring devices be compliant or hybrid-joined, monitoring enrollment activity, and regularly reviewing policies to prevent bypass and abuse.

Remediation

CLI
Terraform
Dashboard steps

New-MgIdentityConditionalAccessPolicy -BodyParameter @{displayName="<example_resource_name>";state="enabled";conditions=@{users=@{includeUsers=@("All")};applications=@{includeUserActions=@("urn:user:registersecurityinfo")}};grantControls=@{operator="OR";builtInControls=@("mfa","domainJoinedDevice")}}

resource "azuread_conditional_access_policy" "<example_resource_name>" {
  display_name = "<example_resource_name>"
  state        = "enabled" # Critical: policy must be enforced (not report-only)

  conditions {
    users {
      include_users = ["All"] # Critical: applies to all users
    }
    applications {
      include_user_actions = ["urn:user:registersecurityinfo"] # Critical: targets security info (MFA) registration
    }
  }

  grant_controls {
    operator          = "OR" # Critical: required by the check logic
    built_in_controls = ["mfa", "domainJoinedDevice"] # Critical: require MFA or hybrid joined device
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_managed_device_required_for_mfa_registration. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Microsoft 365 checks

Conditional Access requires a managed device to sign in Organization has password hash synchronization enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires