CISA.MS.AAD.3.1: Phishing-resistant MFA SHALL be enforced for all users.

ID	CISA.MS.AAD.3.1
Severity	High
Suite	CISA SCuBA baselines
Product	Entra ID
Feature	Conditional Access
Security area	Authentication
Resource type	Tenant
User impact of fixing	High
Effort to fix	High
Benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.AAD.3.1 (SHALL)
Framework controls	cisa-scuba:MS.AAD.3.1 nist-800-53-r5:IA-2(1) Identification and Authentication (Organizational Users) | Multi-factor Authentication to Privileged Accounts nist-800-53-r5:IA-2(2) Identification and Authentication (Organizational Users) | Multi-factor Authentication to Non-privileged Accounts nist-800-53-r5:IA-5c Authenticator Management nist-800-53-r5:IA-5g Authenticator Management nist-800-53-r5:IA-2(8) Identification and Authentication (Organizational Users) | Access to Accounts — Replay Resistant
MITRE ATT&CK	T1566.002
Reads from	Microsoft Graph
Licence needed	AAD_PREMIUM

What this checks and how to fix it

Phishing-resistant MFA SHALL be enforced for all users.

Rationale: Weaker forms of MFA do not protect against sophisticated phishing attacks. By enforcing methods resistant to phishing, those risks are minimized.

Remediation action:

Create a Conditional Access policy enforcing phishing-resistant MFA for all users. Configure the following policy settings in the new Conditional Access policy, per the values below:

• Users > Include > All users
• Target resources > Cloud apps > All cloud apps
• Access controls > Grant > Grant Access > Require authentication strength > Phishing-resistant MFA

Related links

• CISA Strong Authentication & Secure Registration - MS.AAD.3.1v1
• CISA ScubaGear Rego Reference

---

Mito check, based on CISA ScubaGear. Author: soulemike. Open-source licences.