Phishing-Resistant MFA

CA105-Admins-IdentityProtection-AnyApp-AnyPlatform-PhishingResistantMFA

Require phishing-resistant MFA

About this policy

The CA105-Admins-IdentityProtection-AnyApp-AnyPlatform-PhishingResistantMFA policy raises the bar for privileged roles by demanding the phishing resistant MFA authentication strength. That means FIDO2 security keys, passkeys or certificate based authentication, methods that cannot be tricked out of a user by a fake sign-in page. It covers all cloud apps for around two dozen admin roles, with a single application excluded to keep tooling workable. If your admins are still approving push notifications, this is the nudge towards stronger credentials.

Policy conditions

Users: Specific users
Apps: All cloud apps

JSON template

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies/$entity",
  "@odata.type": "#microsoft.graph.conditionalAccessPolicy",
  "@odata.id": "identity/conditionalAccess/policies('d2cebefb-fc77-4986-8890-4fe511825ee7')",
  "@odata.editLink": "identity/conditionalAccess/policies('d2cebefb-fc77-4986-8890-4fe511825ee7')",
  "templateId": "76c03f19-ea37-4656-a772-a183b4ddb81d",
  "displayName": "CA105-Admins-IdentityProtection-AnyApp-AnyPlatform-PhishingResistantMFA",
  "createdDateTime@odata.type": "#DateTimeOffset",
  "modifiedDateTime@odata.type": "#DateTimeOffset",
  "state@odata.type": "#microsoft.graph.conditionalAccessPolicyState",
  "state": "enabledForReportingButNotEnforced",
  "deletedDateTime": null,
  "partialEnablementStrategy": null,
  "sessionControls": null,
  "conditions": {
    "@odata.type": "#microsoft.graph.conditionalAccessConditionSet",
    "userRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
    "userRiskLevels": [],
    "signInRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
    "signInRiskLevels": [],
    "clientAppTypes@odata.type": "#Collection(microsoft.graph.conditionalAccessClientApp)",
    "clientAppTypes": [
      "all"
    ],
    "platforms": null,
    "locations": null,
    "times": null,
    "deviceStates": null,
    "devices": null,
    "clientApplications": null,
    "agents": null,
    "applications": {
      "@odata.type": "#microsoft.graph.conditionalAccessApplications",
      "includeApplications@odata.type": "#Collection(String)",
      "includeApplications": [
        "All"
      ],
      "excludeApplications@odata.type": "#Collection(String)",
      "excludeApplications": [
        "14d82eec-204b-4c2f-b7e8-296a70dab67e"
      ],
      "includeUserActions@odata.type": "#Collection(String)",
      "includeUserActions": [],
      "includeAuthenticationContextClassReferences@odata.type": "#Collection(String)",
      "includeAuthenticationContextClassReferences": [],
      "applicationFilter": null
    },
    "users": {
      "@odata.type": "#microsoft.graph.conditionalAccessUsers",
      "includeUsers@odata.type": "#Collection(String)",
      "includeUsers": [],
      "excludeUsers@odata.type": "#Collection(String)",
      "excludeUsers": [],
      "includeGroups@odata.type": "#Collection(String)",
      "includeGroups": [],
      "excludeGroups@odata.type": "#Collection(String)",
      "excludeGroups": [
        "2802b872-ccfb-4b29-a9a9-459808dfb11b",
        "ab2172b3-67e0-4b55-b538-21467c8ebd45"
      ],
      "includeRoles@odata.type": "#Collection(String)",
      "includeRoles": [
        "62e90394-69f5-4237-9190-012177145e10",
        "194ae4cb-b126-40b2-bd5b-6091b380977d",
        "f28a1f50-f6e7-4571-818b-6a12f2af6b6c",
        "29232cdf-9323-42fd-ade2-1d097af3e4de",
        "b1be1c3e-b65d-4f19-8427-f6fa0d97feb9",
        "729827e3-9c14-49f7-bb1b-9608f156bbb8",
        "b0f54661-2d74-4c50-afa3-1ec803f12efe",
        "fe930be7-5e62-47db-91af-98c3a49a38b1",
        "c4e39bd9-1100-46d3-8c65-fb160da0071f",
        "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3",
        "158c047a-c907-4556-b7ef-446551a6b5f7",
        "966707d0-3269-4727-9be2-8c3a10f19b9d",
        "7be44c8a-adaf-4e2a-84d6-ab2649e08a13",
        "e8611ab8-c189-46e8-94e1-60213ab1f814",
        "f2ef992c-3afb-46b9-b7cf-a126ee74c451",
        "3a2c62db-5318-420d-8d74-23affee5d9d5",
        "db506228-d27e-4b7d-95e5-295956d6615f",
        "6b942400-691f-4bf0-9d12-d8a254a2baf5",
        "d2562ede-74db-457e-a7b6-544e236ebb61",
        "e93e3737-fa85-474a-aee4-7d3fb86510f3",
        "b6a27b2b-f905-4b2e-81b5-0d90e0ef1fdb",
        "1707125e-0aa2-4d4d-8655-a7c786c76a25",
        "69091246-20e8-4a56-aa4d-066075b2a7a8",
        "11451d60-acb2-45eb-a7d6-43d0f0125c13"
      ],
      "excludeRoles@odata.type": "#Collection(String)",
      "excludeRoles": [],
      "includeGuestsOrExternalUsers": null,
      "excludeGuestsOrExternalUsers": null
    }
  },
  "grantControls": {
    "@odata.type": "#microsoft.graph.conditionalAccessGrantControls",
    "operator": "OR",
    "builtInControls@odata.type": "#Collection(microsoft.graph.conditionalAccessGrantControl)",
    "builtInControls": [],
    "customAuthenticationFactors@odata.type": "#Collection(String)",
    "customAuthenticationFactors": [],
    "termsOfUse@odata.type": "#Collection(String)",
    "termsOfUse": [],
    "authenticationStrength@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies('d2cebefb-fc77-4986-8890-4fe511825ee7')/grantControls/authenticationStrength/$entity",
    "authenticationStrength@odata.associationLink": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('d2cebefb-fc77-4986-8890-4fe511825ee7')/grantControls/authenticationStrength/$ref",
    "authenticationStrength@odata.navigationLink": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('d2cebefb-fc77-4986-8890-4fe511825ee7')/grantControls/authenticationStrength",
    "authenticationStrength": {
      "id": "00000000-0000-0000-0000-000000000004"
    }
  },
  "#microsoft.graph.restore": {
    "title": "microsoft.graph.restore",
    "target": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('d2cebefb-fc77-4986-8890-4fe511825ee7')/microsoft.graph.restore"
  },
  "Tag": "jv-CAF-2026.2.1",
  "summary": "The CA105-Admins-IdentityProtection-AnyApp-AnyPlatform-PhishingResistantMFA policy raises the bar for privileged roles by demanding the phishing resistant MFA authentication strength. That means FIDO2 security keys, passkeys or certificate based authentication, methods that cannot be tricked out of a user by a fake sign-in page. It covers all cloud apps for around two dozen admin roles, with a single application excluded to keep tooling workable. If your admins are still approving push notifications, this is the nudge towards stronger credentials."
}