CISA.MS.AAD.3.6 - Phishing-resistant MFA SHALL be required for highly privileged roles.

Contributed by Michael Soule with Michael Morten SonneAll contributors →

Overview

Phishing-resistant MFA SHALL be required for highly privileged roles.

Rationale: This is a backup security policy to help protect privileged access to the tenant if the Conditional Access policy, which requires MFA for all users, is disabled or misconfigured.

Remediation action:

Create a Conditional Access policy enforcing phishing-resistant MFA for highly privileged roles. Configure the following policy settings in the new Conditional Access policy, per the values below:

1. In Entra under Protection and Conditional Access, select Policies.
2. Click on New policy
3. Under New Conditional Access policy, configure the following policy settings in the new Conditional Access policy, per the values below:
   • Users > Include > Select users and groups > Directory roles > select each of the roles listed in the Highly Privileged Roles listed.
   • Target resources > Cloud apps > All cloud apps
   • Access controls > Grant > Grant Access > Require authentication strength > Phishing-resistant MFA
4. Click Save.

Related links

• Entra admin center - Conditional Access | Policies
• CISA Strong Authentication & Secure Registration - MS.AAD.3.6v1
• CISA ScubaGear Rego Reference
• CISA ScubaGear Highly Privileged Roles

Test Metadata

Field	Value
Test ID	CISA.MS.AAD.3.6
Severity	High
Suite	CISA
Product	Entra ID
Feature	Conditional Access
Area	Privileged access
Resource type	Tenant
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	T1078.004 Cloud Accounts, T1566.002 Spearphishing Link
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.3.6
Criticality	SHALL
Upstream requirement	MS.AAD.3.6v1
Supports controls	cisa-scuba:MS.AAD.3.6, nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-5c, nist-800-53-r5:IA-5g, nist-800-53-r5:IA-2(8)
PowerShell test	Test-MtCisaPrivilegedPhishResistant
Services	Graph
Compatible licenses	AAD_PREMIUM

Source

• Test: tests/cisa/entra/Test.CISA.MS.AAD.3.6.ps1
• Documentation: tests/cisa/entra/Test.CISA.MS.AAD.3.6.md