EIDCA-018: Managed Device Required for MFA Registration
- Platform
- Entra ID / M365
- Category
- Entra ID Conditional Access
- Severity
- Medium
- Zero Trust pillar
- Identity (weight 3)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Requiring an agency-managed (compliant or Hybrid Entra joined) device for the security-information registration action reduces the risk of an adversary using stolen credentials to enroll their own MFA method and establish persistence. SCuBA recommends that managed devices be required to register MFA. This is implemented as a Conditional Access policy targeting the 'Register security information' user action and requiring a compliant device or Hybrid Entra ID joined device as a grant control. This check inspects enabled Conditional Access policies for that configuration.
Recommended value
An enabled Conditional Access policy targets the security-information registration user action and requires a compliant or Hybrid Entra ID joined device
Remediation
Create a Conditional Access policy to require a managed device for MFA registration, satisfying SCuBA MS.AAD.3.8. Target the user action 'Register security information', scope it to all users (excluding break-glass accounts), and set the grant control to require a compliant device or Hybrid Entra ID joined device. Pilot in report-only mode, ensure a bootstrap path exists for new devices (for example Temporary Access Pass), then enable enforcement.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-data | Not Assessed |
Framework mappings
- CISA SCuBA
- MS.AAD.3.8v1
- NIST SP 800-53
- IA-2(1), IA-5, AC-19
- MITRE ATT&CK
- T1556.006