EIDAUTH-017: Per-User MFA vs Conditional Access MFA Conflict Detection
- Platform
- Entra ID / M365
- Category
- Entra ID Authentication Methods & MFA
- Severity
- Medium
- Zero Trust pillar
- Identity (weight 3)
- Golden fixtures
- 1
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Legacy per-user MFA settings (enabled/enforced at the individual user level) can conflict with Conditional Access-based MFA policies, creating unpredictable authentication behavior. When both are active, users may experience duplicate MFA prompts, authentication failures, or inconsistent policy enforcement depending on which mechanism evaluates first. Organizations should migrate entirely to Conditional Access-based MFA and disable per-user MFA settings to ensure consistent policy application.
Recommended value
Per-user MFA disabled for all users with MFA enforced exclusively through Conditional Access policies
Remediation
Check per-user MFA status via Entra ID > Users > Per-user MFA and identify users with per-user MFA enabled or enforced. Create equivalent Conditional Access policies that enforce MFA for all users before disabling per-user MFA. Disable per-user MFA by setting each user's status to Disabled after confirming Conditional Access MFA coverage is complete.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| always-warn | WARN |
Framework mappings
- NIST SP 800-53
- IA-2(1)
- CIS M365 Benchmark
- 5.2.2.1