Control: 5.2.2.9 Ensure a managed device is required for authentication

Description

Conditional Access (CA) can be configured to enforce access based on the device's compliance status or whether it is Entra hybrid joined. Collectively this allows CA to classify devices as managed or unmanaged, providing more granular control over authentication policies.

When using Require device to be marked as compliant, the device must pass checks configured in Compliance policies defined within Intune (Endpoint Manager). Before these checks can be applied, the device must first be enrolled in Intune MDM.

By selecting Require Microsoft Entra hybrid joined device this means the device must first be synchronized from an on-premises Active Directory to qualify for authentication.

When configured to the recommended state below only one condition needs to be met for the user to authenticate from the device. This functions as an "OR" operator.

The recommended state is:

Require device to be marked as compliant
Require Microsoft Entra hybrid joined device
Require one of the selected controls

Remediation

To remediate using the UI:

Navigate to Microsoft Entra admin center https://entra.microsoft.com/.
Click to expand Protection > Conditional Access select Policies.
Create a new policy by selecting New policy.
- Under Users include All users.
- Under Target resources include All resources (formerly 'All cloud apps').
- Under Grant select Grant access.
- Select only the checkboxes Require device to be marked as compliant and Require Microsoft Entra hybrid joined device.
- Choose Require one of the selected controls and click Select at the bottom.
Under Enable policy set it to Report-only until the organization is ready to enable it.
Click Create.

Note: Guest user accounts, if collaborating with the organization, should be considered when testing this policy.

Usage

Run the control in your terminal:

powerpipe control run microsoft365_compliance.control.cis_v500_5_2_2_9

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run microsoft365_compliance.control.cis_v500_5_2_2_9 --share

SQL

This control uses a named query:

with tenant_list as (
  select distinct on (tenant_id) tenant_id, _ctx
  from azuread_user
),
conditional_access_policy as (
  select
    tenant_id,
    count(*) as conditional_access_policy_count
  from
    azuread_conditional_access_policy
  where
    users -> 'includeUsers' ? 'All'
    and built_in_controls @> '[2,3]'::jsonb
    and operator = 'OR'
    and applications -> 'includeApplications' ? 'All'
    and state = 'enabled'
  group
    by tenant_id
)
select
  t.tenant_id as resource,
  case
    when conditional_access_policy_count > 0 then 'ok'
    else 'alarm'
  end as status,
  case
    when conditional_access_policy_count > 0 then t.tenant_id || ' has a conditional access policy requiring users to authenticate only from a compliant or hybrid-joined device.'
    else t.tenant_id || ' does not have a conditional access policy requiring users to authenticate only from a compliant or hybrid-joined device.'
  end as reason
  , t.tenant_id as tenant_id
from
  tenant_list as t
  left join conditional_access_policy as p on p.tenant_id = t.tenant_id;

Control: 5.2.2.9 Ensure a managed device is required for authentication

Description

Remediation

Usage

SQL

Tags