CISA.MS.AAD.3.1 - Phishing-resistant MFA SHALL be enforced for all users.

Contributed by Michael SouleAll contributors →

Overview

Phishing-resistant MFA SHALL be enforced for all users.

Rationale: Weaker forms of MFA do not protect against sophisticated phishing attacks. By enforcing methods resistant to phishing, those risks are minimized.

The test passes when an enabled Conditional Access policy for all users and all cloud apps requires the built-in Phishing-resistant MFA authentication strength, or a custom authentication strength limited to Windows Hello for Business, passkeys (FIDO2) and certificate-based multifactor authentication.

Remediation action:

Create a Conditional Access policy enforcing phishing-resistant MFA for all users. Configure the following policy settings in the new Conditional Access policy, per the values below:

• Users > Include > All users
• Target resources > Cloud apps > All cloud apps
• Access controls > Grant > Grant Access > Require authentication strength > Phishing-resistant MFA

Related links

• CISA Strong Authentication & Secure Registration - MS.AAD.3.1v1
• CISA ScubaGear Rego Reference

Test Metadata

Field	Value
Test ID	CISA.MS.AAD.3.1
Severity	High
Suite	CISA
Product	Entra ID
Feature	Conditional Access
Area	Authentication
Resource type	Tenant
User impact	High
Implementation cost	High
MITRE ATT&CK	T1566.002 Spearphishing Link
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.3.1
Criticality	SHALL
Upstream requirement	MS.AAD.3.1v1
Supports controls	cisa-scuba:MS.AAD.3.1, nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2), nist-800-53-r5:IA-5c, nist-800-53-r5:IA-5g, nist-800-53-r5:IA-2(8)
PowerShell test	Test-MtCisaPhishResistant
Services	Graph
Compatible licenses	AAD_PREMIUM

Source

• Test: tests/cisa/entra/Test.CISA.MS.AAD.3.1.ps1
• Documentation: tests/cisa/entra/Test.CISA.MS.AAD.3.1.md