Back to Checks
m365

Conditional Access requires strong authentication and Every Time sign-in frequency for Intune Enrollment

entra_intune_enrollment_sign_in_frequency_every_time
Service: entraSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Microsoft Entra Conditional Access for Microsoft Intune Enrollment must require strong authentication and set sign-in frequency to Every time for all users.

This check evaluates whether an active policy targets the Intune Enrollment app, requires MFA or authentication strength, and forces reauthentication on each enrollment attempt.

Prowler logoProwlerprowler-provider-m365

Risk

Absent strong authentication and Every time reauthentication at enrollment, attackers with stolen or replayed credentials can enroll rogue devices and obtain compliant access.

Impacts:

  • Confidentiality: data exposure from unauthorized devices
  • Integrity: untrusted endpoints modifying resources
  • Availability: persistence via device-based access paths

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks entra_intune_enrollment_sign_in_frequency_every_time

Recommendation

Implement a Conditional Access policy on the Intune Enrollment app that requires MFA or authentication strength and sets sign-in frequency to Every time.

Microsoft Entra requires this grant control when Every time is configured for Intune Enrollment, so Prowler validates both conditions together in a single check.

Remediation

CLI

az rest --method POST --url https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies --headers 'Content-Type=application/json' --body '{"displayName":"Intune Enrollment - MFA and Every time","state":"enabled","conditions":{"users":{"includeUsers":["All"]},"applications":{"includeApplications":["d4ebce55-015a-49b5-a083-c84d1797ae8c"]}},"grantControls":{"operator":"OR","builtInControls":["mfa"]},"sessionControls":{"signInFrequency":{"isEnabled":true,"type":"everyTime"}}}'

Terraform

resource "azuread_conditional_access_policy" "<example_resource_name>" {
  display_name = "<example_resource_name>"
  state        = "enabled"

  conditions {
    users {
      include_users = ["All"] # critical: include all users
    }
    applications {
      include_applications = ["d4ebce55-015a-49b5-a083-c84d1797ae8c"] # critical: target Microsoft Intune Enrollment app
    }
  }

  session_controls {
    sign_in_frequency {
      is_enabled = true      # critical: enable sign-in frequency control
      type       = "everyTime" # critical: require reauthentication every time
    }
  }
}

Other

1Sign in to Microsoft Entra admin center (entra.microsoft.com)
2Go to Protection > Conditional Access > Policies > New policy
3Users > Include: select All users
4Target resources (Resources/Cloud apps) > Select resources: choose Microsoft Intune Enrollment (App ID: `d4ebce55-015a-49b5-a083-c84d1797ae8c`)
5Grant > Grant access: select either Require multifactor authentication or Require authentication strength
6Session > Sign-in frequency: select Every time
7Enable policy: On
8Create the policy

Check Code

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.entra.entra_client import entra_client
from prowler.providers.m365.services.entra.entra_service import (
    ConditionalAccessGrantControl,
    ConditionalAccessPolicyState,
    GrantControlOperator,
    SignInFrequencyInterval,
)


class entra_intune_enrollment_sign_in_frequency_every_time(Check):
    """Ensure Intune enrollment enforces strong auth and Every Time sign-in."""

    def execute(self) -> list[CheckReportM365]:
        """Execute the check to ensure that sign-in frequency for Intune Enrollment is set to 'Every time'.

        Returns:
            list[CheckReportM365]: A list containing the results of the check.
        """
        findings = []

        report = CheckReportM365(
            metadata=self.metadata(),
            resource={},
            resource_name="Conditional Access Policies",
            resource_id="conditionalAccessPolicies",
        )
        report.status = "FAIL"
        report.status_extended = (
            "No Conditional Access Policy requires strong authentication and "
            "enforces Every Time sign-in frequency for Intune Enrollment."
        )

        for policy in entra_client.conditional_access_policies.values():
            if policy.state == ConditionalAccessPolicyState.DISABLED:
                continue

            if (
                "d4ebce55-015a-49b5-a083-c84d1797ae8c"
                not in policy.conditions.application_conditions.included_applications
            ):
                continue

            if (
                "d4ebce55-015a-49b5-a083-c84d1797ae8c"
                in policy.conditions.application_conditions.excluded_applications
            ):
                continue

            if "All" not in policy.conditions.user_conditions.included_users:
                continue

            requires_mfa = (
                ConditionalAccessGrantControl.MFA
                in policy.grant_controls.built_in_controls
            )
            requires_authentication_strength = (
                policy.grant_controls.authentication_strength is not None
            )

            if not (requires_mfa or requires_authentication_strength):
                continue

            if (
                policy.grant_controls.operator == GrantControlOperator.OR
                and len(policy.grant_controls.built_in_controls) > 1
            ):
                continue

            if not policy.session_controls.sign_in_frequency.is_enabled:
                continue

            if (
                policy.session_controls.sign_in_frequency.interval
                == SignInFrequencyInterval.EVERY_TIME
            ):
                report = CheckReportM365(
                    metadata=self.metadata(),
                    resource=policy,
                    resource_name=policy.display_name,
                    resource_id=policy.id,
                )
                if policy.state == ConditionalAccessPolicyState.ENABLED_FOR_REPORTING:
                    report.status = "FAIL"
                    report.status_extended = (
                        f"Conditional Access Policy '{policy.display_name}' reports "
                        "strong authentication and Every Time sign-in frequency for "
                        "Intune Enrollment but does not enforce them."
                    )
                else:
                    report.status = "PASS"
                    report.status_extended = (
                        f"Conditional Access Policy '{policy.display_name}' requires "
                        "strong authentication and enforces Every Time sign-in "
                        "frequency for Intune Enrollment."
                    )
                    break

        findings.append(report)
        return findings

References