CISA.MS.AAD.3.4: The Authentication Methods Manage Migration feature SHALL be set to Migration Complete.

ID	CISA.MS.AAD.3.4
Severity	High
Suite	CISA SCuBA baselines
Product	Entra ID
Feature	Authentication methods
Security area	Authentication
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Medium
Benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.AAD.3.4 (SHALL)
Framework controls	cisa-scuba:MS.AAD.3.4 nist-800-53-r5:CM-7 Least Functionality
Reads from	Microsoft Graph
Licence needed	AAD_PREMIUM

What this checks and how to fix it

The Authentication Methods Manage Migration feature SHALL be set to Migration Complete.

Rationale: To disable the legacy authentication methods screen for the tenant, configure the Manage Migration feature to Migration Complete. The MFA and Self-Service Password Reset (SSPR) authentication methods are both managed from a central admin page, thereby reducing administrative complexity and potential security misconfigurations.

Remediation action

If phishing-resistant MFA has not been enforced for all users yet, create a Conditional Access policy that enforces MFA but does not dictate MFA method. Configure the following policy settings in the new Conditional Access policy, per the values below:

1. Go through the process of migrating from the legacy Azure AD MFA and Self-Service Password Reset (SSPR) administration pages to the new unified Authentication Methods policy page.
2. Once ready to finish the migration, set the Manage Migration option to Migration Complete.

Related links

• CISA Strong Authentication & Secure Registration - MS.AAD.3.4v1
• CISA ScubaGear Rego Reference

---

Mito check, based on CISA ScubaGear. Author: soulemike. Open-source licences.