What this check looks at
Checks for a Conditional Access policy that controls where and how people register MFA methods and password reset details.
Security info is the set of methods a person registers for MFA and password reset (Microsoft Authenticator, phone numbers, security keys and so on), managed at https://aka.ms/mysecurityinfo. By default, someone signed in with only a password can register their first methods there. Conditional Access can protect this with the Register security information user action, requiring MFA, a trusted location or a compliant device before anything can be registered.
This check applies where the tenant has Conditional Access (Entra ID P1). It looks for a policy that targets the Register security information user action. It passes when such a policy is On and warns when it is only in report-only mode. The check fails when there is none.
The gap is the time between an account being created, or its methods being reset, and its owner registering MFA. An attacker who phishes or sprays the password in that window can register their own authenticator app, and from then on passes MFA as that person, often without the real owner noticing that an extra method is there.
Why it matters
If registering a new MFA method needs only a password, anyone who phishes a password before its owner sets up MFA can register their own phone and keep the account. Protecting registration closes that window.
A typical case: a 70-person firm creates accounts for a new team a week before they start, with temporary passwords sent to their personal email. One personal mailbox is compromised; the attacker signs in with the temporary password and registers their own phone. When the employee starts, they register their own method too, not realising the attacker’s is already there. The attacker has a lasting way in.
Protecting registration closes that window for new starters and after MFA resets, and costs little: in the office registration works as before, and elsewhere a Temporary Access Pass from IT counts as MFA.
CISA SCuBA MS.AAD.3.8 and CIS Microsoft 365 Foundations Benchmark 5.2.2.10 ask for a managed device to be required to register MFA and security information, which goes further than this check. CIS Controls v8 safeguard 6.3, ISO 27001 A.5.17 and A.8.5, the NCSC CAF identity verification and authentication outcome and NIST CSF PR.AA-01 expect credentials to be issued securely.
How to fix it
Where: Entra admin centre → Protection → Conditional Access
Before you start
- Mark the office IP ranges as a trusted named location, so registering in the office stays simple.
- Make sure new starters receive a Temporary Access Pass, which counts as MFA, so they can register from home.
- Create the policy in report-only mode first and review its results in Entra ID sign-in logs (Conditional Access tab) for at least a week.
Step by step
- Mark the office as a trusted location. In the Microsoft Entra admin centre, go to Entra ID > Conditional Access > Named locations and make sure each office’s public IP range exists as an IP ranges location with Mark as trusted location ticked (see the named locations finding).
- Make Temporary Access Pass available. In Entra ID > Authentication methods > Policies, enable Temporary Access Pass for all users. New starters, and anyone whose methods are reset, then get a one-time pass from IT, which counts as MFA and lets them register from anywhere.
- Create the policy in report-only mode. Go to Entra ID > Conditional Access > Policies > New policy (or use the template Securing security info registration) and name it "Protect security info registration". Under Users, include All users and exclude All guest and external users and your emergency access accounts. Under Target resources, choose User actions and tick Register security information. Under Conditions > Locations, set Configure to Yes, include any location and exclude all trusted locations. Under Grant choose Require multifactor authentication (or Require device to be marked as compliant, which CIS and SCuBA ask for). Set Enable policy to Report-only and Create.
- Review the results. After a week, check Entra ID > Monitoring & health > Sign-in logs for registration sign-ins (application My Signins) and their Report-only results, and make sure new starters in that period received a Temporary Access Pass and were not stuck.
- Switch it on and update the new-starter process. Set Enable policy to On and Save. Change the new-starter process so the first sign-in uses a Temporary Access Pass handed over by IT, not a temporary password sent by email.
- Confirm registration needs MFA. From outside a trusted location, sign in as a test account that has a password but no methods and open https://aka.ms/mysecurityinfo: it should ask for MFA or a Temporary Access Pass before allowing registration. The finding clears at the next assessment.
What users will notice
Registering or changing MFA methods outside the office asks for MFA (or a Temporary Access Pass) first.
How to confirm it worked
From outside a trusted location, open aka.ms/mysecurityinfo with a test account: it should ask for MFA before showing the methods.
Frameworks and controls
This check maps to controls in 14 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.a Identity verification, authentication and authorisation |
| DSPT | Standard 4: Managing data access |
| NIS2 | Art. 21(2)(j) Multi-factor authentication and secured communications |
| Microsoft Cloud Security Benchmark | IM-6 Use strong authentication controls |
| Zero Trust | Identities |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.5.3 Use multi-factor authentication |
| CMMC Level 2 | IA.L2-3.5.3 Multifactor Authentication |
| ISO 27001:2022 | A.5.17 Authentication informationA.8.5 Secure authentication |
| CISA SCuBA | MS.AAD.3.8v1 Managed devices required to register MFA |
| CIS M365 | 5.2.2.10 Ensure a managed device is required to register security information |
| CIS Controls v8.1 | 6.3 Require MFA for externally-exposed applications (IG1) |
| NIST CSF 2.0 | PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Securing security info registration (Microsoft Learn)