Use the Conformity Knowledge Base AI to help improve your Cloud Posture

Require Multi-Factor Auth To Join Devices

Trend Micro Cloud One™ – Conformity is a continuous assurance tool that provides peace of mind for your cloud infrastructure, delivering over 750 automated best practice checks.

Risk Level: Medium (should be achieved)
Rule ID: ActiveDirectory-022

Ensure that "Require Multi-Factor Auth to join devices" feature is enabled within your Microsoft Entra ID settings in order to request Multi-Factor Authentication (MFA) for all user accounts, on all systems, whether managed on-site or by a third-party provider, when registering their devices. This enforces Microsoft Entra ID users to access your resources from devices that meet your standards for security and compliance.

This rule resolution is part of the Conformity Security & Compliance tool for Azure.

Security

Multi-Factor Authentication should be mandatory when users are adding devices to the Microsoft Entra ID. This ensures that no rogue devices can be registered to your directory by compromised user accounts. When "Require Multi-Factor Auth to join devices" is set to "Yes", users who are adding devices from the Internet are forced to use the second method of authentication before their devices can be successfully added to your directory.


Audit

To determine if Multi-Factor Authentication is required for device enrollment in your Microsoft Entra ID account, perform the following actions:

Note: Getting "Enable an 'All Users' group in the directory" feature configuration status using Microsoft Graph API or Azure CLI is not currently supported.

Using Azure Console

01 Sign in to Azure Management Console.

02 Navigate to Microsoft Entra ID blade at https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview.

03 In the navigation panel, select Devices.

04 In the Manage section, under All devices, select Device settings to access Microsoft Entra ID device general settings.

05 On Device settings page, check the Require Multi-Factor Auth to join devices feature settings. If the feature configuration is set to No, Multi-Factor Authentication (MFA) is not required when adding devices to the current Microsoft Entra ID, therefore the configuration is not compliant.

06 Repeat steps no. 3 – 5 for each Microsoft Entra ID that you want to examine.

Remediation / Resolution

By setting "Require Multi-Factor Auth to join devices" to "Yes", all Microsoft Entra ID users that are adding devices to your directory are challenged to use a second method of authentication. To turn on the necessary feature, perform the following actions:

Note: Enabling "Require Multi-Factor Auth to join devices" feature using Microsoft Graph API or Azure CLI is not currently supported.

Using Azure Console

01 Sign in to Azure Management Console.

02 Navigate to Microsoft Entra ID blade at https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview.

03 In the navigation panel, select Devices.

04 In the Manage section, under All devices, select Device settings to access Microsoft Entra ID device general settings.

05 On the Device settings page, select Yes next to Require Multi-Factor Auth to join devices configuration setting to enable the feature.

06 Click Save to apply the changes. If successful, the following message should be displayed: "Successfully updated device settings". Once the configuration changes are saved, all users that are adding devices to your directory must use Multi-Factor Authentication (MFA).

07 Repeat steps no. 3 – 6 for each Microsoft Entra ID that you want to reconfigure in order to enable MFA for requesting a second method of authentication when joining devices.

References

Publication date May 21, 2019

Unlock the Remediation Steps


Free 30-day Trial

Automatically audit your configurations with Conformity
and gain access to our cloud security platform.

Confirmity Cloud Platform

No thanks, back to article

You are auditing:

Require Multi-Factor Auth To Join Devices

Risk Level: Medium