Information
Joining devices to the active directory should require Multi-factor authentication.
Rationale:
Multi-factor authentication is recommended when adding devices to Azure AD. When set to 'Yes', users who are adding devices from the internet must first use the second method of authentication before their device is successfully added to the directory. This ensures that rogue devices are not added to the directory for a compromised user account.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
From Azure Console
Go to Azure Active Directory
Go to Devices
Go to Device settings
Set Require Multi-Factor Auth to join devices to Yes
Default Value:
By default, Require Multi-Factor Auth to join devices is set to No.