EIDCA-018: Managed Device Required for MFA Registration
- Plataforma
- Entra ID / M365
- Categoría
- Entra ID Conditional Access
- Severidad
- Medium
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Requiring an agency-managed (compliant or Hybrid Entra joined) device for the security-information registration action reduces the risk of an adversary using stolen credentials to enroll their own MFA method and establish persistence. SCuBA recommends that managed devices be required to register MFA. This is implemented as a Conditional Access policy targeting the 'Register security information' user action and requiring a compliant device or Hybrid Entra ID joined device as a grant control. This check inspects enabled Conditional Access policies for that configuration.
Valor recomendado
An enabled Conditional Access policy targets the security-information registration user action and requires a compliant or Hybrid Entra ID joined device
Remediación
Create a Conditional Access policy to require a managed device for MFA registration, satisfying SCuBA MS.AAD.3.8. Target the user action 'Register security information', scope it to all users (excluding break-glass accounts), and set the grant control to require a compliant device or Hybrid Entra ID joined device. Pilot in report-only mode, ensure a bootstrap path exists for new devices (for example Temporary Access Pass), then enable enforcement.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-data | Not Assessed |
Mapeos a marcos de referencia
- CISA SCuBA
- MS.AAD.3.8v1
- NIST SP 800-53
- IA-2(1), IA-5, AC-19
- MITRE ATT&CK
- T1556.006