Microsoft Entra ID policies should have 'Require Multifactor Authentication to register or join devices with Microsoft Entra' set to 'Yes'
Powerpipe check ad_require_mfa_for_device_join covers 'Require Multifactor Authentication to register or join devices with Microsoft Entra' being set to 'Yes'. It is only relevant if the subscription is using Per-User MFA.
What this control checks
Checks the Microsoft Entra device registration and join MFA setting in the tenant policy
Framework mappings
The clauses this control is mapped to in each framework.
- 5.22 Ensure that 'Require Multifactor Authentication to register or join devices with Microsoft Entra' is set to 'Yes'
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
ad_require_mfa_for_device_join - Powerpipe Control:
azure_compliance.control.ad_require_mfa_for_device_join
Last reviewed: 2026-10-09
Microsoft Entra ID policies should have 'Guest users access restrictions' set to 'Guest user access is restricted to properties and memberships of their own directory objects'
Previous Page
Microsoft Entra ID policies should have 'User consent for applications' set to 'Allow user consent for apps from verified publishers, for selected permissions'
Next Page