CISA.MS.AAD.3.7: Managed devices SHOULD be required for authentication.

ID	CISA.MS.AAD.3.7
Severity	High
Suite	CISA SCuBA baselines
Product	Entra ID
Feature	Conditional Access
Security area	Access control
Resource type	Tenant
User impact of fixing	High
Effort to fix	High
Benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.AAD.3.7 (SHOULD)
Framework controls	cisa-scuba:MS.AAD.3.7 nist-800-53-r5:AC-20b Use of External Systems nist-800-53-r5:IA-3 Device Identification and Authentication
MITRE ATT&CK	T1078.004
Reads from	Microsoft Graph
Licence needed	AAD_PREMIUM

What this checks and how to fix it

Managed devices SHOULD be required for authentication.

Rationale: The security risk of an adversary authenticating to the tenant from their own device is reduced by requiring a managed device to authenticate. Managed devices are under the provisioning and control of the agency. OMB-22-09 states, “When authorizing users to access resources, agencies must consider at least one device-level signal alongside identity information about the authenticated user.”

Remediation action:

Create a Conditional Access policy requiring a user’s device to be either Microsoft Entra hybrid joined or compliant during authentication. Configure the following policy settings in the new Conditional Access policy, per the values below:

1. In Entra under Protection and Conditional Access, select Policies.
2. Click on New policy
3. Under New Conditional Access policy, configure the following policy settings in the new Conditional Access policy, per the values below:
   • Users > Include > All users
   • Target resources > Cloud apps > All cloud apps
   • Access controls > Grant > Grant Access > Require device to be marked as compliant and Require Microsoft Entra hybrid joined device > For multiple controls > Require one of the selected controls
4. Click Save.

Related links

• Entra admin center - Conditional Access | Policies
• CISA Strong Authentication & Secure Registration - MS.AAD.3.7v1
• CISA ScubaGear Rego Reference

---

Mito check, based on CISA ScubaGear. Author: soulemike; contributors: michaelmsonne. Open-source licences.