CISA.MS.AAD.3.2 - If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users.

Contributed by Michael SouleAll contributors →

Overview

If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users.

Rationale: This is a stopgap security policy to help protect the tenant if phishing-resistant MFA has not been enforced. This policy requires MFA enforcement, thus reducing single-form authentication risk.

Remediation action:

If phishing-resistant MFA has not been enforced for all users yet, create a Conditional Access policy that enforces MFA but does not dictate MFA method. Configure the following policy settings in the new Conditional Access policy, per the values below:

• Users > Include > All users
• Target resources > Cloud apps > All cloud apps
• Access controls > Grant > Grant Access > Require multifactor authentication

Related links

• CISA Strong Authentication & Secure Registration - MS.AAD.3.2v1
• CISA ScubaGear Rego Reference

Test Metadata

Field	Value
Test ID	CISA.MS.AAD.3.2
Severity	High
Suite	CISA
Product	Entra ID
Feature	Conditional Access
Area	Authentication
Resource type	Tenant
User impact	Medium
Implementation cost	Medium
MITRE ATT&CK	T1110 Brute Force, T1078.004 Cloud Accounts
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.3.2
Criticality	SHALL
Upstream requirement	MS.AAD.3.2v2
Supports controls	cisa-scuba:MS.AAD.3.2, nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2)
PowerShell test	Test-MtCisaMfa
Services	Graph
Compatible licenses	AAD_PREMIUM

Source

• Test: tests/cisa/entra/Test.CISA.MS.AAD.3.2.ps1
• Documentation: tests/cisa/entra/Test.CISA.MS.AAD.3.2.md