CIS Microsoft 365 Conditional Access Controls: All 17 Recommendations in 5.2.2

Section 5 of the CIS Microsoft 365 Foundations Benchmark v7.0.0 is the largest: 63 of the 160 controls. Inside it, subsection 5.2.2 is the one that governs Conditional Access, and it holds 17 recommendations, all of them marked Automated in the benchmark. This post walks through all 17, grouped by what they protect, with the exact recommendation numbers and profile for each.

What 5.2.2 contains at a glance

The 17 controls split across four profiles:

• E3 Level 1: 10 controls
• E3 Level 2: 4 controls (5.2.2.5, 5.2.2.14, 5.2.2.15, 5.2.2.16)
• E5 Level 1: 2 controls (5.2.2.6, 5.2.2.7)
• E5 Level 2: 1 control (5.2.2.8)

So 12 of the 17 are Level 1 and 5 are Level 2. The two Identity Protection risk-policy controls and the sign-in risk block carry the E5 profile; the rest are E3. If you are unsure how the profiles map to your licensing, see E3 vs E5 controls and licensing.

Multifactor authentication and legacy authentication

These are the controls most assessments flag first.

• 5.2.2.1 — Ensure multifactor authentication is enabled for all users in administrative roles (E3 Level 1)
• 5.2.2.2 — Ensure multifactor authentication is enabled for all users (E3 Level 1)
• 5.2.2.3 — Enable Conditional Access policies to block legacy authentication (E3 Level 1)

5.2.2.1 and 5.2.2.2 are deliberately separate: one targets administrative roles, the other all users. Passing the first does not imply the second. 5.2.2.3 closes the other door, since a policy that requires MFA does little for sign-ins that arrive through a legacy authentication path.

Administrator sessions and phishing resistance

• 5.2.2.4 — Ensure Sign-in frequency is enabled and browser sessions are not persistent for Administrative users (E3 Level 1)
• 5.2.2.5 — Ensure 'Phishing-resistant MFA strength' is required for Administrators (E3 Level 2)

5.2.2.5 is Level 2, so it will not show up in a Level 1-only baseline. Teams working toward Level 2 should plan for it explicitly.

Identity Protection risk policies (E5)

• 5.2.2.6 — Enable Identity Protection user risk policies (E5 Level 1)
• 5.2.2.7 — Enable Identity Protection sign-in risk policies (E5 Level 1)
• 5.2.2.8 — Ensure 'sign-in risk' is blocked for medium and high risk (E5 Level 2)

All three depend on the E5 profile. If your tenant is E3-only, these are the controls to mark as licensing-dependent rather than failing.

Device requirements and enrollment

• 5.2.2.9 — Ensure a managed device is required for authentication (E3 Level 1)
• 5.2.2.10 — Ensure a managed device is required to register security information (E3 Level 1)
• 5.2.2.11 — Ensure sign-in frequency for Intune Enrollment is set to 'Every time' (E3 Level 1)

Device code flow, reauthentication and authentication transfer

• 5.2.2.12 — Ensure the device code sign-in flow is blocked (E3 Level 1)
• 5.2.2.13 — Ensure that periodic reauthentication is required for all users (E3 Level 1)

• 5.2.2.17 — Ensure authentication transfer is blocked (E3 Level 1)

5.2.2.12 is the control behind the device code phishing pattern. We cover that attack in our device code phishing post.

Locations and token protection (Level 2)

• 5.2.2.14 — Ensure trusted 'named locations' are defined (E3 Level 2)
• 5.2.2.15 — Ensure exclusionary geographic access controls are utilized (E3 Level 2)
• 5.2.2.16 — Ensure Token Protection is enforced for session tokens (E3 Level 2)

A practical order of work

1. Start with 5.2.2.1, 5.2.2.2 and 5.2.2.3: administrator MFA, all-user MFA, legacy authentication blocked.
2. Add the Level 1 session and device controls: 5.2.2.4, 5.2.2.9, 5.2.2.10, 5.2.2.11, 5.2.2.12, 5.2.2.13 and 5.2.2.17.
3. Evaluate the E5 risk-policy controls (5.2.2.6, 5.2.2.7) if your licensing includes them.
4. Move to the Level 2 set: 5.2.2.5, 5.2.2.8, 5.2.2.14, 5.2.2.15 and 5.2.2.16.

Conditional Access policies interact, so a tenant can pass one control while a broad exclusion quietly undermines another. For that failure mode, see Conditional Access exclusions and the MFA gap.

Checking all 17 automatically

ConfigCobra assesses all 160 controls of the CIS Microsoft 365 Foundations Benchmark v7.0.0 using read-only Microsoft Graph permissions, with results in 20–25 minutes and a PDF report with findings and evidence. Each finding comes with a copy-paste remediation script (PowerShell or admin portal steps). See the CIS Microsoft 365 benchmark page for the full section breakdown.

The free trial gives you 14 days with full access. Start a free trial or contact us to have your tenant provisioned.