Protect · Established tier · Identity and Access

PR-02Phishing-resistant MFA for privileged access

Administrative and privileged access uses hardware-backed MFA. SMS, passwords and push approval are not accepted.

Status

Partial evidence

2 items only partly support it.

Exposure

Critical

2 evidence items from 1 sources

CCSA · Protect

Below Foundational

Not blocking this domain's next tier.

What the evidence shows

12 privileged administrators still approve sign-ins by push, and 84 legacy branch users are excluded from the MFA policy.

Remediation · Identity and Access

Issue FIDO2 keys to the 12 administrators and retire the GRP-BRANCH-OPS-LEGACY exclusion, which expired 63 days ago.

Every item is read-only, dated, hashed and re-runnable. This is what an examiner can test.

ev-pr02-1

Phishing-resistant MFA in place for 400 of 412 privileged administrators

Microsoft Entra ID · config · collected 1 h ago (Oct 15, 2026 · 12:59 UTC) · limit 48 h

Partial

Query: GET /identity/conditionalAccess/policies/CA-003 · GET /reports/authenticationMethods/userRegistrationDetails?$filter=isAdmin eq true
Identity: app assurance-ro (Policy.Read.All, AuditLog.Read.All)
Collector: entra-collector 2.7.0
Window: 24 h
Records: 412
SHA-256: b0ac387842ff44aa615ad0bd324841c4c0c188f9e6caaf28aff84148ab4ae77f

ev-pr02-2

MFA policy excludes 84 users; the exception expired 63 days ago

Microsoft Entra ID · config · collected 1 h ago (Oct 15, 2026 · 12:59 UTC) · limit 48 h

Partial