Ensure that "Require Multi-Factor Auth to join devices" feature is enabled within your Microsoft Entra ID settings in order to request Multi-Factor Authentication (MFA) for all user accounts, on all systems, whether managed on-site or by a third-party provider, when registering their devices. This enforces Microsoft Entra ID users to access your resources from devices that meet your standards for security and compliance.
This rule resolution is part of the Conformity Security & Compliance tool for Azure.
Security Multi-Factor Authentication should be mandatory when users are adding devices to the Microsoft Entra ID. This ensures that no rogue devices can be registered to your directory by compromised user accounts. When "Require Multi-Factor Auth to join devices" is set to "Yes", users who are adding devices from the Internet are forced to use the second method of authentication before their devices can be successfully added to your directory.
Audit
To determine if Multi-Factor Authentication is required for device enrollment in your Microsoft Entra ID account, perform the following actions:
Note: Getting "Enable an 'All Users' group in the directory" feature configuration status using Microsoft Graph API or Azure CLI is not currently supported.Remediation / Resolution
By setting "Require Multi-Factor Auth to join devices" to "Yes", all Microsoft Entra ID users that are adding devices to your directory are challenged to use a second method of authentication. To turn on the necessary feature, perform the following actions:
Note: Enabling "Require Multi-Factor Auth to join devices" feature using Microsoft Graph API or Azure CLI is not currently supported.