Require MFA
CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA
Require MFA · Sign-in frequency enforced
About this policy
The CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA policy protects the Microsoft Intune Enrollment service. Internal users must complete multifactor authentication, and the sign-in frequency is set to every time, so each enrolment attempt triggers a fresh challenge. Device enrolment is a sensitive moment, as whoever enrols a device gains a managed, trusted foothold in your environment. Making the user prove their identity at that exact point stops an attacker with a stolen session from sneaking a rogue device into management.
Policy conditions
JSON template
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies/$entity",
"@odata.type": "#microsoft.graph.conditionalAccessPolicy",
"@odata.id": "identity/conditionalAccess/policies('891a23cb-2710-497c-a4f9-ec01f1131cde')",
"@odata.editLink": "identity/conditionalAccess/policies('891a23cb-2710-497c-a4f9-ec01f1131cde')",
"templateId": null,
"displayName": "CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA",
"createdDateTime@odata.type": "#DateTimeOffset",
"modifiedDateTime@odata.type": "#DateTimeOffset",
"state@odata.type": "#microsoft.graph.conditionalAccessPolicyState",
"state": "enabled",
"deletedDateTime": null,
"partialEnablementStrategy": null,
"conditions": {
"@odata.type": "#microsoft.graph.conditionalAccessConditionSet",
"userRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
"userRiskLevels": [],
"signInRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
"signInRiskLevels": [],
"clientAppTypes@odata.type": "#Collection(microsoft.graph.conditionalAccessClientApp)",
"clientAppTypes": [
"all"
],
"platforms": null,
"locations": null,
"times": null,
"deviceStates": null,
"devices": null,
"clientApplications": null,
"agents": null,
"applications": {
"@odata.type": "#microsoft.graph.conditionalAccessApplications",
"includeApplications@odata.type": "#Collection(String)",
"includeApplications": [
"d4ebce55-015a-49b5-a083-c84d1797ae8c"
],
"excludeApplications@odata.type": "#Collection(String)",
"excludeApplications": [],
"includeUserActions@odata.type": "#Collection(String)",
"includeUserActions": [],
"includeAuthenticationContextClassReferences@odata.type": "#Collection(String)",
"includeAuthenticationContextClassReferences": [],
"applicationFilter": null
},
"users": {
"@odata.type": "#microsoft.graph.conditionalAccessUsers",
"includeUsers@odata.type": "#Collection(String)",
"includeUsers": [],
"excludeUsers@odata.type": "#Collection(String)",
"excludeUsers": [],
"includeGroups@odata.type": "#Collection(String)",
"includeGroups": [
"ceeac9b8-ddf5-48cb-afcb-e2ab8bfd1a57"
],
"excludeGroups@odata.type": "#Collection(String)",
"excludeGroups": [
"2802b872-ccfb-4b29-a9a9-459808dfb11b",
"2eee133e-3427-4860-81b9-057d5b28b022"
],
"includeRoles@odata.type": "#Collection(String)",
"includeRoles": [],
"excludeRoles@odata.type": "#Collection(String)",
"excludeRoles": [],
"includeGuestsOrExternalUsers": null,
"excludeGuestsOrExternalUsers": null
}
},
"grantControls": {
"@odata.type": "#microsoft.graph.conditionalAccessGrantControls",
"operator": "OR",
"builtInControls@odata.type": "#Collection(microsoft.graph.conditionalAccessGrantControl)",
"builtInControls": [
"mfa"
],
"customAuthenticationFactors@odata.type": "#Collection(String)",
"customAuthenticationFactors": [],
"termsOfUse@odata.type": "#Collection(String)",
"termsOfUse": [],
"authenticationStrength@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies('891a23cb-2710-497c-a4f9-ec01f1131cde')/grantControls/authenticationStrength/$entity",
"authenticationStrength@odata.associationLink": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('891a23cb-2710-497c-a4f9-ec01f1131cde')/grantControls/authenticationStrength/$ref",
"authenticationStrength@odata.navigationLink": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('891a23cb-2710-497c-a4f9-ec01f1131cde')/grantControls/authenticationStrength",
"authenticationStrength": null
},
"sessionControls": {
"@odata.type": "#microsoft.graph.conditionalAccessSessionControls",
"disableResilienceDefaults": null,
"applicationEnforcedRestrictions": null,
"cloudAppSecurity": null,
"persistentBrowser": null,
"continuousAccessEvaluation": null,
"secureSignInSession": null,
"blockSensitiveActions": null,
"signInFrequency": {
"@odata.type": "#microsoft.graph.signInFrequencySessionControl",
"value": null,
"type": null,
"authenticationType@odata.type": "#microsoft.graph.signInFrequencyAuthenticationType",
"authenticationType": "primaryAndSecondaryAuthentication",
"frequencyInterval@odata.type": "#microsoft.graph.signInFrequencyInterval",
"frequencyInterval": "everyTime",
"isEnabled": true
}
},
"#microsoft.graph.restore": {
"title": "microsoft.graph.restore",
"target": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('891a23cb-2710-497c-a4f9-ec01f1131cde')/microsoft.graph.restore"
},
"Tag": "jv-CAF-2026.2.1",
"summary": "The CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA policy protects the Microsoft Intune Enrollment service. Internal users must complete multifactor authentication, and the sign-in frequency is set to every time, so each enrolment attempt triggers a fresh challenge. Device enrolment is a sensitive moment, as whoever enrols a device gains a managed, trusted foothold in your environment. Making the user prove their identity at that exact point stops an attacker with a stolen session from sneaking a rogue device into management."
}