Device Compliance

CIS - Require managed device to register security info

Require compliant device · Require hybrid Azure AD join

About this policy

The CIS - Require managed device to register security info policy restricts who can register or update security information such as MFA methods and passwordless credentials. Only users signing in from a compliant or hybrid Azure AD joined device are permitted to make these changes. This closes off a common persistence tactic where an attacker who has compromised credentials registers their own MFA method on an unmanaged device to maintain access.

Policy conditions

Users: All users
Apps: Security info registration

JSON template

{
  "templateId": null,
  "displayName": "CIS - Require managed device to register security info",
  "modifiedDateTime": null,
  "state": "enabledForReportingButNotEnforced",
  "deletedDateTime": null,
  "partialEnablementStrategy": null,
  "sessionControls": null,
  "conditions": {
    "userRiskLevels": [],
    "signInRiskLevels": [],
    "clientAppTypes": [
      "all"
    ],
    "platforms": null,
    "locations": null,
    "times": null,
    "deviceStates": null,
    "devices": null,
    "clientApplications": null,
    "agents": null,
    "applications": {
      "includeApplications": [],
      "excludeApplications": [],
      "includeUserActions": [
        "urn:user:registersecurityinfo"
      ],
      "includeAuthenticationContextClassReferences": [],
      "applicationFilter": null
    },
    "users": {
      "includeUsers": [
        "All"
      ],
      "excludeUsers": [],
      "includeGroups": [],
      "excludeGroups": [],
      "includeRoles": [],
      "excludeRoles": [],
      "includeGuestsOrExternalUsers": null,
      "excludeGuestsOrExternalUsers": null
    }
  },
  "grantControls": {
    "operator": "OR",
    "builtInControls": [
      "compliantDevice",
      "domainJoinedDevice"
    ],
    "customAuthenticationFactors": [],
    "termsOfUse": [],
    "authenticationStrength@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies('4a082e1c-a202-4415-8eef-5214365a840b')/grantControls/authenticationStrength/$entity",
    "authenticationStrength": null
  },
  "Tag": "CIS",
  "summary": "The CIS - Require managed device to register security info policy restricts who can register or update security information such as MFA methods and passwordless credentials. Only users signing in from a compliant or hybrid Azure AD joined device are permitted to make these changes. This closes off a common persistence tactic where an attacker who has compromised credentials registers their own MFA method on an unmanaged device to maintain access."
}