Require MFA

CIS - Signin everytime for Intune enrollment

Require MFA · Sign-in frequency enforced

About this policy

The CIS - Signin everytime for Intune enrollment policy requires MFA and a fresh sign-in every time a user accesses the Intune Enrolment application. By disabling session persistence for this specific app, it ensures that device enrolment actions always require an active, verified authentication rather than relying on an existing session. This adds a meaningful checkpoint to the enrolment process and reduces the risk of unauthorised device enrolments from a hijacked browser session.

Policy conditions

Users: All users
Apps: d4ebce55-015a-49b5-a083-c84d1797ae8c

JSON template

{
  "templateId": null,
  "displayName": "CIS - Signin everytime for Intune enrollment",
  "modifiedDateTime": null,
  "state": "enabledForReportingButNotEnforced",
  "deletedDateTime": null,
  "partialEnablementStrategy": null,
  "conditions": {
    "userRiskLevels": [],
    "signInRiskLevels": [],
    "clientAppTypes": [
      "all"
    ],
    "platforms": null,
    "locations": null,
    "times": null,
    "deviceStates": null,
    "devices": null,
    "clientApplications": null,
    "agents": null,
    "applications": {
      "includeApplications": [
        "d4ebce55-015a-49b5-a083-c84d1797ae8c"
      ],
      "excludeApplications": [],
      "includeUserActions": [],
      "includeAuthenticationContextClassReferences": [],
      "applicationFilter": null
    },
    "users": {
      "includeUsers": [
        "All"
      ],
      "excludeUsers": [],
      "includeGroups": [],
      "excludeGroups": [],
      "includeRoles": [],
      "excludeRoles": [],
      "includeGuestsOrExternalUsers": null,
      "excludeGuestsOrExternalUsers": null
    }
  },
  "grantControls": {
    "operator": "OR",
    "builtInControls": [
      "mfa"
    ],
    "customAuthenticationFactors": [],
    "termsOfUse": [],
    "authenticationStrength@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies('16c37a86-488e-4d29-9ad4-1428288b78de')/grantControls/authenticationStrength/$entity",
    "authenticationStrength": null
  },
  "sessionControls": {
    "disableResilienceDefaults": null,
    "applicationEnforcedRestrictions": null,
    "cloudAppSecurity": null,
    "persistentBrowser": null,
    "continuousAccessEvaluation": null,
    "secureSignInSession": null,
    "blockSensitiveActions": null,
    "signInFrequency": {
      "value": null,
      "type": null,
      "authenticationType": "primaryAndSecondaryAuthentication",
      "frequencyInterval": "everyTime",
      "isEnabled": true
    }
  },
  "Tag": "CIS",
  "summary": "The CIS - Signin everytime for Intune enrollment policy requires MFA and a fresh sign-in every time a user accesses the Intune Enrolment application. By disabling session persistence for this specific app, it ensures that device enrolment actions always require an active, verified authentication rather than relying on an existing session. This adds a meaningful checkpoint to the enrolment process and reduces the risk of unauthorised device enrolments from a hijacked browser session."
}