CISA.MS.AAD.3.2: If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users.

ID	CISA.MS.AAD.3.2
Severity	High
Suite	CISA SCuBA baselines
Product	Entra ID
Feature	Conditional Access
Security area	Authentication
Resource type	Tenant
User impact of fixing	Medium
Effort to fix	Medium
Benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.AAD.3.2 (SHALL)
Framework controls	cisa-scuba:MS.AAD.3.2 nist-800-53-r5:IA-2(1) Identification and Authentication (Organizational Users) | Multi-factor Authentication to Privileged Accounts nist-800-53-r5:IA-2(2) Identification and Authentication (Organizational Users) | Multi-factor Authentication to Non-privileged Accounts
MITRE ATT&CK	T1110, T1078.004
Reads from	Microsoft Graph
Licence needed	AAD_PREMIUM

What this checks and how to fix it

If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users.

Rationale: This is a stopgap security policy to help protect the tenant if phishing-resistant MFA has not been enforced. This policy requires MFA enforcement, thus reducing single-form authentication risk.

Remediation action:

If phishing-resistant MFA has not been enforced for all users yet, create a Conditional Access policy that enforces MFA but does not dictate MFA method. Configure the following policy settings in the new Conditional Access policy, per the values below:

• Users > Include > All users
• Target resources > Cloud apps > All cloud apps
• Access controls > Grant > Grant Access > Require multifactor authentication

Related links

• CISA Strong Authentication & Secure Registration - MS.AAD.3.2v1
• CISA ScubaGear Rego Reference

---

Mito check, based on CISA ScubaGear. Author: soulemike. Open-source licences.