CISA.MS.AAD.3.4 - The Authentication Methods Manage Migration feature SHALL be set to Migration Complete.

Contributed by Michael SouleAll contributors →

Overview

The Authentication Methods Manage Migration feature SHALL be set to Migration Complete.

Rationale: To disable the legacy authentication methods screen for the tenant, configure the Manage Migration feature to Migration Complete. The MFA and Self-Service Password Reset (SSPR) authentication methods are both managed from a central admin page, thereby reducing administrative complexity and potential security misconfigurations.

Remediation action

If phishing-resistant MFA has not been enforced for all users yet, create a Conditional Access policy that enforces MFA but does not dictate MFA method. Configure the following policy settings in the new Conditional Access policy, per the values below:

1. Go through the process of migrating from the legacy Azure AD MFA and Self-Service Password Reset (SSPR) administration pages to the new unified Authentication Methods policy page.
2. Once ready to finish the migration, set the Manage Migration option to Migration Complete.

Related links

• CISA Strong Authentication & Secure Registration - MS.AAD.3.4v1
• CISA ScubaGear Rego Reference

Test Metadata

Field	Value
Test ID	CISA.MS.AAD.3.4
Severity	Low
Suite	CISA
Product	Entra ID
Feature	Authentication methods
Area	Authentication
Resource type	Tenant
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	None
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.3.4
Criticality	SHALL
Upstream requirement	MS.AAD.3.4v1
Supports controls	cisa-scuba:MS.AAD.3.4, nist-800-53-r5:CM-7
PowerShell test	Test-MtCisaMethodsMigration
Services	Graph
Compatible licenses	AAD_PREMIUM

Source

• Test: tests/cisa/entra/Test.CISA.MS.AAD.3.4.ps1
• Documentation: tests/cisa/entra/Test.CISA.MS.AAD.3.4.md