What this check looks at
Checks for an enabled Conditional Access policy for all users on Microsoft Intune Enrollment that requires MFA and signs people in again every time they enrol a device.
Enrolling a device in Intune is how it becomes managed and, once compliant, trusted by Conditional Access. Enrolment signs in to the Microsoft Intune Enrolment app (app ID d4ebce55-015a-49b5-a083-c84d1797ae8c), and by default it accepts whatever session the person already has, including MFA done hours or days earlier.
The check, for tenants with Entra ID P1 and Intune, looks for an enabled policy for All users that targets the Intune enrolment app (or all resources), requires MFA or an authentication strength, and sets sign-in frequency to Every time. It warns when such a policy is only in report-only mode and fails when there is none.
If enrolment reuses an existing session, someone holding a stolen session token can enrol a device of their own and, once it reports compliant, pass every "managed device" rule in the tenant. Requiring a fresh MFA at the moment of enrolment means whoever enrols must have the account’s second factor in hand.
Why it matters
Enrolling a device makes it trusted. If enrolment reuses an existing session, someone with a stolen session token can enrol their own device and pass every "managed device" check; signing in again every time stops that.
Device-based Conditional Access is one of the strongest controls a small organisation can deploy, but it is only as strong as the step that makes a device trusted. An attacker who stole a session cookie through phishing could otherwise enrol a virtual machine, make it compliant, and reach data the policies were meant to keep on company devices.
Enrolment is rare (a new laptop, a rebuild, a new phone), so an extra MFA prompt at that moment costs staff nothing noticeable, while closing one of the few routes round device compliance.
The CIS Microsoft 365 Foundations Benchmark (5.2.2.11) asks for sign-in frequency Every time for Intune enrolment. The rule maps to NIST CSF 2.0 PR.AA-03.
How to fix it
Where: Entra admin centre → Protection → Conditional Access
Before you start
- Check the Microsoft Intune Enrollment app is listed in Enterprise applications; it appears once Intune is set up.
- Create the policy in report-only mode first and review its results in Entra ID sign-in logs (Conditional Access tab) for at least a week.
Step by step
- Check the enrolment app is in the tenant. In the Microsoft Entra admin centre, go to Entra ID > Enterprise apps > All applications, set Application type to All applications and search for d4ebce55-015a-49b5-a083-c84d1797ae8c. If it is missing, create it in Microsoft Graph PowerShell: Connect-MgGraph -Scopes Application.ReadWrite.All, then New-MgServicePrincipal -AppId d4ebce55-015a-49b5-a083-c84d1797ae8c.
- Create the policy and choose the app. Go to Entra ID > Conditional Access > Policies > New policy, named "CA – All users – Intune enrolment – MFA every time". Users: All users, excluding the emergency access group. Target resources: Select resources, search for Intune and select the Intune enrolment app, checking its app ID is d4ebce55-015a-49b5-a083-c84d1797ae8c (it is not the app called Microsoft Intune).
- Set the grant and session, in report-only mode. Under Grant, choose Grant access and tick Require multifactor authentication (or an authentication strength). Under Session, tick Sign-in frequency and choose Every time. Set Enable policy to Report-only and select Create.
- Test an enrolment. Enrol a test device, or re-enrol one through Company Portal, and check in Entra ID > Monitoring & health > Sign-in logs that the enrolment sign-in shows this policy on the Report-only tab, with MFA required.
- Switch the policy on. Set Enable policy to On and select Save. Tell the service desk that every enrolment will now ask for MFA, even straight after another sign-in.
- Confirm. Open the policy and check it shows On, the Intune enrolment app, Require multifactor authentication and Sign-in frequency Every time. Re-run the assessment to confirm the finding passes.
What users will notice
Enrolling a device in Intune always asks for MFA, even if the person signed in recently.
How to confirm it worked
The policy is On, targets Microsoft Intune Enrollment, requires MFA and shows sign-in frequency Every time.
Frameworks and controls
This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.b Device management |
| DSPT | Standard 9: IT protection |
| NIS2 | Art. 21(2)(j) Multi-factor authentication and secured communications |
| Microsoft Cloud Security Benchmark | IM-7 Restrict resource access based on conditions |
| Zero Trust | Endpoints |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.5.3 Use multi-factor authentication |
| CMMC Level 2 | IA.L2-3.5.3 Multifactor Authentication |
| ISO 27001:2022 | A.8.1 User endpoint devicesA.8.5 Secure authentication |
| CIS M365 | 5.2.2.11 Ensure sign-in frequency for Intune Enrollment is set to 'Every time' |
| CIS Controls v8.1 | 6.3 Require MFA for externally-exposed applications (IG1) |
| NIST CSF 2.0 | PR.AA-03: Users, services, and hardware are authenticated |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Require reauthentication every time (Microsoft Learn)