Microsoft Entra ID policies should have 'Require Multifactor Authentication to register or join devices with Microsoft Entra' set to 'Yes'
Powerpipe check ad_require_mfa_for_device_join covers 'Require Multifactor Authentication to register or join devices with Microsoft Entra' being set to 'Yes'. It is only relevant if the subscription is using Per-User MFA.
What this control checks
Checks the Microsoft Entra device registration and join MFA setting in the tenant policy
Common pitfalls
Applies only to subscriptions using Per-User MFA
This recommendation is only relevant if your subscription is using Per-User MFA.
Conditional Access is the preferred method if licensed
If your organization is licensed to use Conditional Access, the preferred method of requiring MFA to join devices to Entra ID is to use a Conditional Access policy.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.ad_require_mfa_for_device_join.
Framework-specific interpretation
CIS Azure Benchmark v5.0.0: Mapped to 5.22 (Ensure that 'Require Multifactor Authentication to register or join devices with Microsoft Entra' is set to 'Yes').
Framework mappings
The clauses this control is mapped to in each framework.
- 5.22 Ensure that 'Require Multifactor Authentication to register or join devices with Microsoft Entra' is set to 'Yes'
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
ad_require_mfa_for_device_join - Powerpipe Control:
azure_compliance.control.ad_require_mfa_for_device_join
Last reviewed: 2026-10-09
Microsoft Entra ID policies should have 'Guest users access restrictions' set to 'Guest user access is restricted to properties and memberships of their own directory objects'
Previous Page
Microsoft Entra ID policies should have 'User consent for applications' set to 'Allow user consent for apps from verified publishers, for selected permissions'
Next Page