MT.1016: At least one Conditional Access policy is configured to require MFA for guest access.

ID	MT.1016
Severity	High
Suite	Mito
Product	Entra ID
Feature	Conditional Access
Security area	Authentication
Resource type	Tenant
User impact of fixing	Medium
Effort to fix	Low
Framework controls	nist-800-53-r5:IA-2(1) Identification and Authentication (Organizational Users) | Multi-factor Authentication to Privileged Accounts nist-800-53-r5:AC-20 Use of External Systems
MITRE ATT&CK	T1078.004, T1110
Reads from	Microsoft Graph
Licence needed	AAD_PREMIUM

What this checks and how to fix it

This check verifies if there is at least one Conditional Access policy that requires multifactor authentication for all guest accounts.

See Require multifactor authentication for guest access - Microsoft Learn

---

Mito check. Author: f-bader; contributors: merill, SamErde. Open-source licences.