EIDAUTH-001: Authentication Methods Policy Audit
- Platform
- Entra ID / M365
- Category
- Entra ID Authentication Methods & MFA
- Severity
- Info
- Zero Trust pillar
- Identity (weight 1)
- Golden fixtures
- 2
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
The authentication methods policy defines which methods are available to users for sign-in and MFA. A misconfigured policy may allow weak or deprecated methods, increasing the attack surface. This check audits the current policy state against recognized Entra ID security baselines.
Recommended value
Authentication methods policy reviewed and aligned with organizational security baseline
Remediation
Navigate to Entra ID > Protection > Authentication methods > Policies. Review each enabled method and disable any that are not required by your organization. Ensure phishing-resistant methods such as FIDO2 and Microsoft Authenticator are prioritized over SMS and voice.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| no-data | Not Assessed |
Framework mappings
- CISA SCuBA
- MS.AAD.3.4v1, MS.AAD.3.5v2
- NIST SP 800-53
- IA-2
- CIS M365 Benchmark
- 5.2.1