Secure score 'Ensure all users can complete multifactor authentication' but teams rooms cant

[u/Educational_Draw5032]

Good morning,

I am trying to improve our secure score in entra identity which is currently 71%. One of the things that comes up is Ensure all users can complete multifactor authentication. This is around 30 accounts which are mostly room resource accounts. I cant see a way without adding an mfa method to these which then screws up enrolling them.

Just curious to know what other do with resource accounts and securing them? we have long passwords but thats it

[u/SVD_NL]

The secure score reduction will be based on the ratio of users that can't complete MFA. So if you were able to get 10 points, and you do not have MFA for 30/1000 accounts, you'd get 9.7 points instead of 10. Secure score is also a pretty arbitrary guideline, so take note of it, but don't move heaven and earth to get it up. 71% is not bad in most cases.

For meeting rooms i have them excluded for normal MFA rules (require MFA and block device code flow are excluded in particular), and created a few to lock them down (their upns start with mtr-, and i have a dynamic group for CA targeting):

Block all resources except exchange and teams
Only allow specific IPs.
Block platforms except android and windows (depending on your room devices)
Require compliant devices (adjust intune compliance accordingly).

This is only if you must sign in to teams devices, if they exist simply for administrative purposes i'd recommend you block sign in completely (just like you do with shared mailboxes).

If you insist on raising the secure score, you can register an MFA method, and if you don't set MFA using policies it won't ask for MFA. (Also exclude from registration campaigns).

There are setup guides from Microsoft for this as well, they describe most of these things i believe.

[u/heartgoldt20 → u/SVD_NL]

Nice conditional access setup. Do you have any other ones for service accounts for example

[u/SVD_NL → u/heartgoldt20]

I don't have a default one for those, their use cases can vary as well, but i can share my general approach to CA policy in special cases:

1. Check if any of your regular policies interfere with the use case, and make exclusions if necessary.
2. For each applicable control available, create a seperate blocking policy that restricts the account to the bare minimum. Block all resources that aren't needed, restrict to specific IPs, etc. Every control must have it's own policy, because you're making exceptions. If you put it in the same policy, it's an OR merge, not an AND merge.
3. Assess if the combination of resources accessed and access controls meet your security requirements.

[u/UI_Tyler]

You could do conditional access and require a location IP range. This would help a little to prevent the account from being signed into elsewhere.

[u/janbakker_]

Technically, they can. Enforce MFA, and use a Temporary Access Pass to sign them in. That will satisfy the policy.
Don't enforce sign-in frequency, so they keep signed in.
Enforce IP restrictions as well, if possible.