EIDSCA.AS04 - Authentication Method - SMS - Use for sign-in.
Overview
Determines if users can use this authentication method to sign in to Microsoft Entra ID. true if users can use this method for primary authentication, otherwise false.
Avoid to use SMS as primary sign in factor (instead of a password) and consider to implement a MFA or passwordless option also for your special user groups, such as front-line workers.
Test script
https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations('Sms')
.includeTargets.isUsableForSignIn -eq 'false'
Remediation action
Microsoft Learn - Configure and enable users for SMS-based authentication using Microsoft Entra ID
Related links
- Open in Graph Explorer
- smsAuthenticationMethodConfiguration resource type - Microsoft Graph beta | Microsoft Learn
Test Metadata
| Field | Value |
|---|---|
| Test ID | EIDSCA.AS04 |
| Severity | High |
| Suite | Entra ID SCA |
| Product | Entra ID |
| Feature | Authentication methods |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1111 Multi-Factor Authentication Interception, T1566.002 Spearphishing Link |
| Supports controls | nist-800-53-r5:CM-7, nist-800-53-r5:IA-5 |
| PowerShell test | Test-MtCheckEidscaAS04 |
| Services | Graph |
Source
- Test:
tests/eidsca/Test.EIDSCA.AS04.ps1 - Documentation:
tests/eidsca/Test.EIDSCA.AS04.md