What it decides

Rule
ENTRA-METHOD-003
Applies to
entra · authentication-methods-policy
Default severity
medium
Basis
documented-guidance

On what authority

Microsoft publishes what each migration state means. In `premigration` the authentication methods policy "is used only for authentication" and "legacy policy settings are respected"; only in `migrationComplete` are the legacy policies ignored. THE DATE IS THE POINT. Microsoft announced the deprecation in March 2023 and set an end: "Beginning September 30, 2025, authentication methods can't be managed in these legacy MFA and SSPR policies." A tenant reporting `premigration` today is having its methods decided by policies that can no longer be administered, which is a governance state rather than a preference -- the settings are in force and out of reach at the same time. This reports the state Microsoft publishes. It does not rank the methods inside either policy, because which policy is in force is a prior question to what it says.

What it needs to decide

  • authentication_methods_policy.policy_migration_state

Without these facts the rule answers unknown, which is not a pass and is not a failure: it is the rule saying the evidence could not settle the question.

Where the evidence comes from

  • tenant-governance: what every user in a tenant may do without asking, and how many accounts hold the role that may do anything · live-validated

What a pass does not establish

A pass says which policy is in force. It says nothing about what that policy permits: a fully migrated tenant can still have every weak method enabled, and this rule would pass.

  • Security questions remain manageable only in the legacy SSPR policy, so even a completed migration leaves one setting behind. A pass here is not a claim that the legacy policies are empty.
  • The number of methods required to reset a password, and the SSPR administrator policy, are documented as remaining active after migration. Neither is read here.

Source

The rule as the Engine holds it, at the revision this page was generated from: 1.0.0b10@0c269e9d29d0.

Generated from capability-manifest/1.0.0 at 1.0.0b10@0c269e9d29d0, contract 1.0.0b10. Every fact on this page is the Engine's; this site publishes it and does not maintain it.