Description:
This control ensures that Single Sign-On (SSO) is enforced for all users within the Microsoft 365 tenant. SSO requires users to authenticate through a centralized Identity Provider before accessing Microsoft 365 services, providing consistent authentication and access control across the organization.


Rationale:
Enforcing SSO centralizes authentication management, improves user experience, and strengthens security by allowing organizations to apply consistent authentication policies, including Multi-Factor Authentication (MFA), Conditional Access policies, and account lifecycle management.


Impact:

  • Centralizes user authentication through a trusted Identity Provider.

  • Reduces reliance on separate application credentials.

  • Improves user access management and security oversight.

  • Supports compliance requirements related to identity and access management.

  • May require integration and maintenance of an external Identity Provider.


Default Value:
Disabled by default. Administrators must explicitly configure and enforce Single Sign-On for Microsoft 365 users.


Remediation

Test Plan

  1. Sign in to the Microsoft Entra admin center with administrative privileges.

  2. Navigate to Enterprise applications.

  3. Review the configured identity provider and federation settings.

  4. Verify that Single Sign-On is enabled for Microsoft 365 authentication.

  5. Select a user account that is subject to the SSO policy.

  6. Attempt to access Microsoft 365 services using the user account.

  7. Verify that the user is redirected to the configured Identity Provider for authentication.

  8. Verify that direct authentication outside the configured Identity Provider is not permitted where SSO enforcement is required.

  9. If SSO is not enforced for all required users, follow the Implementation Plan to remediate the issue and repeat the test.


Implementation Steps:

  1. Sign in to the Microsoft Entra admin center with Global Administrator privileges.

  2. Navigate to Identity → Enterprise applications.

  3. Select the application used for identity federation or configure Microsoft Entra ID as the organization's Identity Provider.

  4. Configure Single Sign-On for the application.

  5. Select the appropriate SSO method (SAML, OpenID Connect, or Password-based SSO) according to organizational requirements.

  6. Configure the required Identity Provider settings and trust relationships.

  7. Assign the application and SSO policy to all applicable users or groups.

  8. Save the configuration changes.

  9. Test authentication using a non-administrative user account.

  10. Verify that users are authenticated through the configured Identity Provider.

  11. Verify that SSO enforcement is applied to all required organization members.


Backout Plan:

  1. Sign in to the Microsoft Entra admin center with Global Administrator privileges.

  2. Navigate to Identity → Enterprise applications.

  3. Select the application configured for Single Sign-On.

  4. Disable Single Sign-On or modify the authentication method as required.

  5. Save the configuration changes.

  6. Verify that users can authenticate according to the updated configuration.

  7. Verify that authentication behavior reflects the updated settings.


References: