MT.1061: Device registration MFA control conflicts with Conditional Access policies.
| ID | MT.1061 |
| Severity | Medium |
| Suite | Mito |
| Product | Entra ID |
| Feature | Conditional Access |
| Security area | Authentication |
| Resource type | ConditionalAccessPolicy |
| User impact of fixing | Low |
| Effort to fix | Low |
| MITRE ATT&CK | T1098.005 |
| Reads from | Microsoft Graph |
What this checks and how to fix it
Section titled “What this checks and how to fix it”When MFA is required during device registration in Conditional Access policies, it must be disabled in the Entra ID Device settings.
When both are enabled, the Conditional Access policy with the “Register or join devices” user action will not work as expected.
Remediation action
Section titled “Remediation action”When a Conditional Access policy is configured with the Register or join devices user action you must disable tenant-wide multifactor requirement for device registration. Otherwise, Conditional Access policies with this user action are not properly enforced.
- Open Entra - Device Settings.
- Set Require Multifactor Authentication to register or join devices with Microsoft Entra to No.
Related links
Section titled “Related links”- Require multifactor authentication for device registration
- Conflicting Conditional Access policies and Entra Device Settings
Mito check. Author: RobbeVandenDaele; contributors: thomas-s-schmidt. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.