CISA.MS.AAD.3.8: Managed Devices SHOULD be required to register MFA.

ID	CISA.MS.AAD.3.8
Severity	High
Suite	CISA SCuBA baselines
Product	Entra ID
Feature	Conditional Access
Security area	Authentication
Resource type	Tenant
User impact of fixing	Medium
Effort to fix	Medium
Benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.AAD.3.8 (SHOULD)
Framework controls	cisa-scuba:MS.AAD.3.8 nist-800-53-r5:AC-20b Use of External Systems nist-800-53-r5:IA-3 Device Identification and Authentication
MITRE ATT&CK	T1078.004, T1098.005
Reads from	Microsoft Graph
Licence needed	AAD_PREMIUM

What this checks and how to fix it

Managed Devices SHOULD be required to register MFA.

Rationale: Reduce risk of an adversary using stolen user credentials and then registering their own MFA device to access the tenant by requiring a managed device provisioned and controlled by the agency to perform registration actions. This prevents the adversary from using their own unmanaged device to perform the registration.

Remediation action:

Create a Conditional Access policy requiring a user to be on a managed device when registering for MFA.

1. In Entra under Protection and Conditional Access, select Policies.
2. Click on New policy
3. Under New Conditional Access policy, configure the following policy settings in the new Conditional Access policy, per the values below:
   • Users > Include > All users
   • Target resources > User actions > Register security information
   • Access controls > Grant > Grant Access > Require device to be marked as compliant and Require Microsoft Entra hybrid joined device > For multiple controls > Require one of the selected controls
4. Click Save.

Related links

• Entra admin center - Conditional Access | Policies
• CISA Strong Authentication & Secure Registration - MS.AAD.3.8v1
• CISA ScubaGear Rego Reference

---

Mito check, based on CISA ScubaGear. Author: soulemike; contributors: michaelmsonne. Open-source licences.