MT.1061 - Device registration MFA control conflicts with Conditional Access policies.
Overview
When MFA is required during device registration in Conditional Access policies, it must be disabled in the Entra ID Device settings.
When both are enabled, the Conditional Access policy with the "Register or join devices" user action will not work as expected.
Remediation action
When a Conditional Access policy is configured with the Register or join devices user action you must disable tenant-wide multifactor requirement for device registration. Otherwise, Conditional Access policies with this user action are not properly enforced.
- Open Entra - Device Settings.
- Set Require Multifactor Authentication to register or join devices with Microsoft Entra to No.
Related links
- Require multifactor authentication for device registration
- Conflicting Conditional Access policies and Entra Device Settings
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1061 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | ConditionalAccessPolicy |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1098.005 Device Registration |
| PowerShell test | Test-MtDeviceRegistrationMfaConflict |
| Services | Graph |
Source
- Test:
tests/maester/entra/Test.MT.1061.ps1 - Documentation:
tests/maester/entra/Test.MT.1061.md