CISA.MS.AAD.3.6: Phishing-resistant MFA SHALL be required for highly privileged roles.

ID	CISA.MS.AAD.3.6
Severity	High
Suite	CISA SCuBA baselines
Product	Entra ID
Feature	Conditional Access
Security area	Privileged access
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Medium
Benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.AAD.3.6 (SHALL)
Framework controls	cisa-scuba:MS.AAD.3.6 nist-800-53-r5:IA-2(1) Identification and Authentication (Organizational Users) | Multi-factor Authentication to Privileged Accounts nist-800-53-r5:IA-5c Authenticator Management nist-800-53-r5:IA-5g Authenticator Management nist-800-53-r5:IA-2(8) Identification and Authentication (Organizational Users) | Access to Accounts — Replay Resistant
MITRE ATT&CK	T1078.004, T1566.002
Reads from	Microsoft Graph
Licence needed	AAD_PREMIUM

What this checks and how to fix it

Phishing-resistant MFA SHALL be required for highly privileged roles.

Rationale: This is a backup security policy to help protect privileged access to the tenant if the Conditional Access policy, which requires MFA for all users, is disabled or misconfigured.

Remediation action:

Create a Conditional Access policy enforcing phishing-resistant MFA for highly privileged roles. Configure the following policy settings in the new Conditional Access policy, per the values below:

1. In Entra under Protection and Conditional Access, select Policies.
2. Click on New policy
3. Under New Conditional Access policy, configure the following policy settings in the new Conditional Access policy, per the values below:
   • Users > Include > Select users and groups > Directory roles > select each of the roles listed in the Highly Privileged Roles listed.
   • Target resources > Cloud apps > All cloud apps
   • Access controls > Grant > Grant Access > Require authentication strength > Phishing-resistant MFA
4. Click Save.

Related links

• Entra admin center - Conditional Access | Policies
• CISA Strong Authentication & Secure Registration - MS.AAD.3.6v1
• CISA ScubaGear Rego Reference
• CISA ScubaGear Highly Privileged Roles

---

Mito check, based on CISA ScubaGear. Author: soulemike; contributors: michaelmsonne. Open-source licences.