General

This checks if conditional access policies are set to enforce extra strong multi-factor authentication (MFA) for administrators.

Rationale

Attackers actively try to bypass MFA to gain access to organizations. Phishing-resistant methods for MFA exist, but they are less user-friendly and/or more expensive to implement. As such, these methods may not be feasible for all users, but are certainly worth considering for accounts with administrative rights.

Attic Fix

A fix is available for this check! This will be offered via a ticket in Attic after which you can accept.

The first time the fix is ​​executed, it will create the policy in report-only mode. This allows you to see in log files which admins would be blocked by the policy, so that you can still provide these admins with additional MFA methods.

The second time, this policy will be changed to 'enabled' after which the policy will actually be enforced.

Manual instruction

Follow these steps to adjust the setting:

1. Open the Entra ID admin portal via https://entra.microsoft.com
2. Go to Protection and then Conditional Access
3. Click on Create new policy from templates
4. Search for phishing
5. Click on the policy with the title "Require phishing-resistant multifactor authentication for admins" and click on Review + create
6. Click on Create to create the policy in Reporting only

On a Later, you can open the policy and set the policy state to On to enable it.

Impact

Admins without phishing-resistant MFA methods registered will no longer be able to log in once the policy is enabled.

More information

1. https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-admin-phish-resistant-mfa