Require a managed device to register MFA in Entra ID

What this check looks at

Checks for an enabled Conditional Access policy for all users on the "Register security information" action whose only grants are a compliant or hybrid-joined device.

Registering security information means adding or changing the methods used for MFA and password reset, at https://aka.ms/mysecurityinfo or when prompted at sign-in. Conditional Access can protect that action itself through the user action Register security information. Without such a policy, a method can be registered from any device, anywhere, by anyone who can sign in.

The check, for tenants with Entra ID P1, looks for an enabled policy that targets All users, applies to the Register security information user action, and whose only grant controls are a compliant device and/or a Microsoft Entra hybrid joined device, as alternatives. Microsoft’s common template for this action, which relies on trusted locations or MFA instead, does not satisfy it. The check warns when such a policy is only in report-only mode and fails when there is none.

The weak moments are before someone has MFA and when they add a new method. An attacker who phishes the password of a new starter who has not registered yet can register their own phone and own the account from then on; an attacker with a live session can add a method of their own to come back later. Requiring a managed device for registration means both would have to happen on a company device.

Why it matters

If a new MFA method can be registered from any device, an attacker who phishes a password before its owner sets up MFA can register their own phone. Requiring a managed device for registration closes that route.

A new starter’s welcome email, with a temporary password, is forwarded to a personal mailbox that is later compromised. The attacker signs in first, registers their own Authenticator, and from then on passes every MFA prompt as that person. The company finds out only when the real person cannot sign in, by which time the attacker has read their mail and sent invoices from it.

The policy also blocks a common persistence step after token theft: adding a new MFA method from the attacker’s machine. Where every member of staff already uses a managed laptop, the cost is negligible; the planning is in how new starters register before their device is ready, which a Temporary Access Pass solves.

The CIS Microsoft 365 Foundations Benchmark (5.2.2.10) and the CISA SCuBA baseline (MS.AAD.3.8v1) both ask for a managed device to be required to register MFA methods. The rule maps to NIST CSF 2.0 PR.AA-01.

How to fix it

Where: Entra admin centre → Protection → Conditional Access

Before you start

• Check new starters can enrol a device before they register MFA (a Temporary Access Pass helps).
• Confirm two emergency access (break-glass) accounts exist and exclude them from the policy, so a mistake cannot lock every administrator out.
• Create the policy in report-only mode first and review its results in Entra ID sign-in logs (Conditional Access tab) for at least a week.

Step by step

1. 1Plan how new starters will register. New starters must reach a compliant device before they can register MFA. Give each a Temporary Access Pass (Entra ID > Users > the person > Authentication methods > Add authentication method), which they use to sign in while setting up their device; once the device is compliant, they register their methods from it.
2. 2Check staff devices are compliant. In the Microsoft Intune admin centre, check Reports > Device compliance: staff devices should be compliant or hybrid joined. People on unmanaged devices will not be able to add or change methods once the policy is on.
3. 3Create the policy in report-only mode. In the Microsoft Entra admin centre, go to Entra ID > Conditional Access > Policies > New policy, named "CA – All users – Register security info from managed device". Users: All users, excluding the emergency access group and Guest or external users. Target resources: choose User actions and tick Register security information. Grant: Grant access, tick Require device to be marked as compliant and Require Microsoft Entra hybrid joined device, with Require one of the selected controls; do not add MFA or a location as an alternative. Set Enable policy to Report-only and select Create.
4. 4Review the report-only results. After a week, look in Entra ID > Monitoring & health > Sign-in logs for security info registrations (they appear against the My Signins application) and check this policy on the Report-only tab. Each one it would have blocked should be from a device you expect to be unmanaged.
5. 5Tell staff and switch the policy on. Tell staff that MFA methods can now be added or changed only from a company device, and that a replacement phone is registered from their company laptop, with a Temporary Access Pass from the service desk if needed. Then set Enable policy to On and select Save.
6. 6Confirm. From an unmanaged browser, sign in as a test user and open https://aka.ms/mysecurityinfo: adding a method should be refused, while from a compliant device it works. Re-run the assessment to confirm the finding passes.

What users will notice

People can only register or change their MFA methods from a compliant or hybrid-joined device.

How to confirm it worked

The policy is On, targets the user action "Register security information" and grants only a compliant or hybrid-joined device.

Frameworks and controls

This check maps to controls in 14 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.

The framework mappings were last checked against the published standards in October 2026.

Microsoft’s documentation

• Securing security info registration (Microsoft Learn)

Related checks

• How to protect MFA registration with Conditional Access
• How to require a managed device for every sign-in
• Security defaults vs Conditional Access: which to use?
• How to block device code sign-in with Conditional Access

The full Microsoft 365 security checklist, worst first