The settingWhat we hold this to
CreativeTechs minimum
A CA policy in state ENABLED (report-only does not count), All users with only the break-glass account excluded, All cloud apps, grant = Require multifactor authentication. MFA registration ≥ 100% of enabled, licensed, non-shared accounts.
Benchmark position
CISA MS.AAD.3.1 — phishing-resistant MFA for all users. Microsoft Secure Score MFARegistrationV2 scores registration coverage proportionally.
Where we differ, and why
CISA's bar is phishing-resistant MFA for everyone. Our floor is any strong method (Authenticator with number matching) for everyone, with phishing-resistant required for admins only — see CTB-19. Closing that gap fleet-wide is a later phase, not a v1 assertion.
Where the switch is
Entra admin centre → Protection → Conditional Access → Policies → New policy. Run it in Report-only for a week first, then flip to On.
How to verify
Graph: /reports/authenticationMethods/userRegistrationDetails → count isMfaRegistered eq false among accountEnabled users
- Why it matters
- The control. Everything else in the baseline exists to support it or to cover what it can't reach.
- How we check
- Maester MT.1007, CISA.MS.AAD.3.1. Secure Score MFARegistrationV2.
- Fix — M365
- CA policy → all users (break-glass excluded) → all cloud apps → require MFA. Run report-only for a week first — it tells you exactly who and what will break before anyone is locked out.
- Fix — Google
- Admin → Security → 2SV → enforcement on, with an enrolment period.
- User notices
- Everyone enrols and gets prompted. This is where the two-week runway goes.
- Expected pushback
- The predictable one, and manageable: a runway, a one-page guide, a hard cutover date, and report-only mode to find the breakage first.