You have a Microsoft 365 E5 subscription.

Assignments

Target resources

Access controls

Set Grant to Require authentication strength

The correct assignment area is Target resources because the policy must apply when users attempt to register or join devices. In Conditional Access, device registration and device join are handled as a user action under target resources, not as a network condition. Microsoft’s Conditional Access deployment guidance explicitly lists the scenario “Require multifactor authentication for device join and device registration using user action,” which confirms that the assignment must target the device-registration/join user action.

The correct access control is Set Grant to Require authentication strength. Plain “Require multifactor authentication” only requires any MFA method that satisfies the MFA claim, such as push notification, SMS, voice, or OATH. That does not guarantee phishing resistance. Microsoft documents that the Require authentication strength grant control lets administrators require a specific authentication strength in Conditional Access. Microsoft’s built-in Phishing-resistant MFA strength includes methods such as FIDO2 security keys, Windows Hello for Business/platform credentials, and multifactor certificate-based authentication.

Therefore, the policy must target the device registration/join user action under Target resources and grant access only when the user satisfies the Phishing-resistant MFA authentication strength.