ID-04: Require Phishing-Resistant MFA for All Users

ID-04 is a security control that phishing attacks can bypass traditional mfa. at level 3, the entire organization uses authentication methods that cryptographically prove user presence, eliminating mfa bypass attacks entirely. It requires that all users must use phishing-resistant mfa (fido2, windows hello, passkeys) and sms and voice call authentication methods are disabled tenant-wide, push notification mfa is disabled or only allowed with number matching.

Phishing attacks can bypass traditional MFA. At Level 3, the entire organization uses authentication methods that cryptographically prove user presence, eliminating MFA bypass attacks entirely.

TrueConfig provides one-click remediation for ID-04. Enables FIDO2 and passkey authentication methods. Users still need to register their own security keys.

This control requires Azure AD Premium P1 (included in Microsoft 365 E3) or higher.

ID-04 is included in the Maximum Security baseline (Level 3). This level is designed for high-security environments and regulated industries.

ID-04 is rated critical because failure to implement this control significantly increases the risk of security incidents. Phishing attacks can bypass traditional MFA. At Level 3, the entire organization uses authentication methods that cryptographically prove user presence, eliminating MFA bypass attacks entirely.