# Control 1.23: Step-Up Authentication for AI Agent Operations

**Control ID:** 1.23<br>
**Pillar:** Security<br>
**Regulatory Reference:** GLBA 501(b), FINRA 4511, FINRA 4530, FINRA 3110, FINRA RN 24-09, SOX 302/404, NIST SP 800-63B, NIST SP 800-53 IA-2, NYDFS 23 NYCRR 500.12<br>
**Last UI Verified:** April 2026<br>
**Governance Levels:** Baseline / Recommended / Regulated<br>

---

## Objective

Implement step-up authentication requirements when AI agents attempt sensitive operations such as financial transactions, data exports, or access to restricted information, requiring re-authentication at the moment of high-risk action.

---

## Why This Matters for FSI

- **GLBA 501(b) Safeguards Rule:** Helps verify customer identity at the point of sensitive data access, supporting the access-control safeguards required for non-public personal information (NPI)
- **FINRA 4511 / RN 24-09:** Supports authorized access to financial books and records at transaction time; FINRA RN 24-09 calls for supervisory oversight of AI-assisted activity at the point of execution (interpretation guidance)
- **FINRA 4530:** Helps create a contemporaneous, attributable authentication record at the moment of material events that may later require disclosure or reporting
- **SOX 302/404:** Provides transaction-level authentication evidence supporting management assertions over internal controls for financial reporting
- **NIST SP 800-63B:** Supports AAL2 / AAL3 authenticator assurance levels at the moment of high-risk action, rather than relying solely on initial sign-in
- **NIST SP 800-53 IA-2 (Identification and Authentication):** Aids in meeting IA-2(1) MFA for privileged accounts and IA-2(2) MFA for non-privileged accounts when paired with re-authentication for sensitive operations
- **NYDFS 23 NYCRR 500.12:** Supports the universal MFA mandate for all individuals accessing covered information systems, including AI-mediated access (effective November 2025)

---

!!! tip "Automation Available"
    Companion solutions in [FSI-AgentGov-Solutions](https://github.com/judeper/FSI-AgentGov-Solutions):

    - [Conditional Access Automation](https://github.com/judeper/FSI-AgentGov-Solutions/tree/main/conditional-access-automation) — CA policy deployment, compliance monitoring, and drift detection for AI workloads
    - [Session Security Configurator](https://github.com/judeper/FSI-AgentGov-Solutions/tree/main/session-security-configurator) — automated session security validation per governance zone with drift detection


## Control Description

This control establishes step-up (re-authentication) requirements at the moment an AI agent — or a user acting through an AI agent — initiates a sensitive operation. Step-up is delivered through Microsoft Entra **Conditional Access authentication contexts** (`c1`–`c25`), which downstream services (Microsoft Copilot Studio flows, custom connectors, Power Automate, SharePoint, Purview, and Graph-protected APIs) request when a sensitive action is invoked. The Conditional Access engine then enforces fresh authentication, **Authentication Strength** (phishing-resistant methods), device compliance, and short sign-in frequency before the action is permitted.

Step-up is layered on top of the baseline Conditional Access posture established in Control 1.11 and the agent identity controls in 1.18. It is not a substitute for baseline MFA — it is a second decision point that runs at the moment of high-risk action so that a compromised long-lived session cannot escalate into a sensitive transaction.

The control includes:

1. **High-risk action classification** — Define which agent actions (financial transactions, bulk data export, external API calls, configuration changes, sensitive queries against regulated data) require step-up, and which do not
2. **Authentication contexts (`c1`–`c5`)** — Mapped to action risk tiers; `c1` is the most restrictive
3. **Conditional Access policies per context** — Each context targeted by a CA policy that requires phishing-resistant Authentication Strength, short sign-in frequency, and (Zone 3) compliant device
4. **Authentication Strengths** — Use the built-in **Phishing-resistant MFA** strength as a baseline; create a custom strength (e.g., `FSI-Critical-Operations`) for the most sensitive contexts when the built-in does not cover the desired method set
5. **Sign-in risk and user risk integration** — Stack risk-based Conditional Access (Identity Protection) on top of context-based policies so that elevated risk forces step-up even when context is not invoked
6. **Privileged Identity Management (PIM)** — For administrative actions on agents (publishing, connector allowlist changes, environment changes), require PIM just-in-time activation with approval and bind activation to a step-up context
7. **Service principal compensating controls** — Because service principals authenticate non-interactively, sensitive SP operations are governed via approval workflows, workload identity Conditional Access, and managed identity with federated credentials rather than interactive step-up
8. **Monitoring and evidence** — Sign-in logs, Conditional Access "what-if" diagnostics, and PIM activation history captured for examination evidence

---

## Key Configuration Points

- Create Authentication Contexts: `c1` (Financial Transaction), `c2` (Data Export), `c3` (External API), `c4` (Config Change), `c5` (Sensitive Query) under **Entra admin center → Protection → Conditional Access → Authentication contexts**
- Create one Conditional Access policy per context (named `FSI-StepUp-<Context>`) targeting the context under **Conditions → Cloud apps or actions → Authentication context**
- Apply the built-in **Phishing-resistant MFA** Authentication Strength on each step-up policy (or a custom strength for `c1`)
- Set sign-in frequency under **Session controls → Sign-in frequency**: 15 minutes for `c1`, 30 minutes for `c2`–`c4`, 60 minutes for `c5` (Zone 3); relax per zone table below
- For Zone 3, require **compliant device** or **Entra hybrid joined device** in the same step-up policy
- Stack a **sign-in risk** Conditional Access policy (Identity Protection) requiring step-up at risk level *medium* or higher
- Stack a **user risk** Conditional Access policy requiring secure password change at risk level *high*
- Configure PIM for administrative roles touching agent infrastructure (Power Platform Admin, Environment Admin, AI Administrator, Purview Data Security AI Admin) with: approval required, justification required, MFA on activation, maximum activation duration ≤ 4 hours
- Implement service principal compensating controls (approval workflow plus workload identity CA) for any sensitive SP operation; do not exempt SPs from governance
- Configure real-time alerting on step-up authentication failures and on Conditional Access policy state changes via Microsoft Sentinel or Defender XDR custom detections
- **Bake step-up policies in report-only mode for at least 72 hours** before flipping to enforcement, and confirm zero unintended block events in sign-in diagnostics

### PIM Integration for Sensitive Agent Operations

Combine step-up authentication with PIM for administrative operations on AI agents:

| Operation | PIM Requirement | Step-Up Context | Combined Control |
|-----------|----------------|-----------------|------------------|
| **Agent Publishing (Zone 3)** | Activate Power Platform Admin | c4 (Config Change) | PIM + 30-min fresh auth |
| **Connector Allowlist Changes** | Activate Power Platform Admin | c4 (Config Change) | PIM + 30-min fresh auth |
| **Agent Deletion** | Activate Environment Admin | c4 (Config Change) | PIM + approval workflow |
| **DSPM Policy Changes** | Activate Purview Admin | c4 (Config Change) | PIM + 15-min fresh auth |
| **Agent Sponsor Assignment** | Activate AI Governance Lead | c5 (Sensitive Query) | PIM + justification required |

**PIM + Step-Up Workflow:**

1. User requests PIM activation for administrative role
2. PIM approval workflow triggers (requires approver consent)
3. Upon activation, step-up authentication context applied
4. User completes phishing-resistant MFA
5. Administrative operation permitted within activation window
6. All actions logged with PIM activation context for audit

---

## Zone-Specific Requirements

| Zone | Requirement | Rationale |
|------|-------------|-----------|
| **Zone 1** (Personal) | Standard MFA (any approved method); 8-hour session; step-up not required for personal-productivity actions; sign-in risk policy still applied | Low-risk, non-regulated content; minimize friction while preserving baseline identity assurance |
| **Zone 2** (Team) | Step-up required for data exports, external API calls, and configuration changes; 4-hour session; 30-minute fresh auth on sensitive actions; phishing-resistant MFA preferred and required for connector allowlist changes | Team data may include limited regulated content; additional verification reduces blast radius of session compromise |
| **Zone 3** (Enterprise) | Mandatory step-up on all sensitive actions (`c1`–`c5`); 1-hour baseline session; 15-minute fresh auth for `c1`; phishing-resistant Authentication Strength required; compliant or hybrid-joined device required; PIM with approval for all admin operations; sign-in risk and user risk policies enforced; real-time monitoring with FSI examination evidence retention | Customer-facing, regulated workloads (FINRA / SEC / NYDFS scope); highest authenticator assurance and shortest re-authentication interval needed at point of action |

---

## Roles & Responsibilities

| Role | Responsibility |
|------|----------------|
| Entra Security Admin | Configure Conditional Access authentication contexts, step-up policies, risk-based policies, and Authentication Strengths |
| Entra Global Admin | Approve tenant-wide authentication method policy changes; act as break-glass for misconfigured step-up policies |
| Entra Privileged Role Admin | Configure PIM role settings (approval, justification, MFA on activation) for roles touching agent infrastructure |
| Authentication Administrator | Assist non-admin users with phishing-resistant method enrollment (FIDO2, Windows Hello, passkey, certificate-based) |
| Power Platform Admin | Map sensitive Copilot Studio / Power Automate actions to the correct authentication context |
| AI Administrator | Identify which agent operations qualify as sensitive and require step-up classification |
| Compliance Officer | Validate action classification against FINRA, SEC, GLBA, and NYDFS expectations and confirm evidence retention |

---

## Related Controls

| Control | Relationship |
|---------|--------------|
| [1.11 - Conditional Access](1.11-conditional-access-and-phishing-resistant-mfa.md) | Baseline CA policies; step-up builds on top ([Conditional Access Automation](https://github.com/judeper/FSI-AgentGov-Solutions/tree/main/conditional-access-automation)) |
| [1.18 - RBAC](1.18-application-level-authorization-and-role-based-access-control-rbac.md) | Entra Agent ID (GA April 2026) enables Conditional Access for agent identities with agent-specific risk signals; role-based access complements step-up |
| [1.4 - Advanced Connector Policies](1.4-advanced-connector-policies-acp.md) | Connector governance enables action-level step-up |
| [1.7 - Audit Logging](1.7-comprehensive-audit-logging-and-compliance.md) | Step-up events must be logged |
| [2.22 - Inactivity Timeout Enforcement](../pillar-2-management/2.22-inactivity-timeout-enforcement.md) | Complementary session controls — 1.23 governs authentication session lifecycle (CA policies via Graph API); 2.22 governs application-level inactivity timeout duration (BAP Admin API) |

!!! tip "Automated Validation: Session Security Configurator"
    For automated deployment, validation, and drift detection of session security controls per governance zone, see the **Session Security Configurator** solution.

    **Capabilities:**

    - Authentication context deployment (c1-c5) with conflict detection
    - Zone-specific CA policy deployment with 72-hour bake period enforcement
    - 5-dimension session security validation (session controls, auth strength, PIM, break-glass, conflict audit)
    - Daily drift detection with Teams adaptive card alerts
    - Compliance evidence export with SHA-256 integrity hashing

    **Deployable Solution:** [session-security-configurator](https://github.com/judeper/FSI-AgentGov-Solutions/tree/main/session-security-configurator) provides PowerShell validation scripts, Dataverse infrastructure, and Power Automate flows.

!!! tip "Automated Compliance: Conditional Access Automation"
    For automated deployment and compliance scanning of Conditional Access policies
    supporting step-up authentication for AI agent operations, see the **Conditional Access Automation** solution.

    **Capabilities:**

    - Automated deployment of authentication context CA policies for agent step-up auth (c1–c5)
    - Zone-specific policy templates enforcing phishing-resistant MFA for sensitive agent operations
    - Daily compliance scanning of CA policy configuration drift for step-up scenarios
    - Teams adaptive card alerts when step-up policies are weakened or disabled
    - SHA-256 evidence export with integrity hashing for FINRA/SEC examination support

    **Deployable Solution:** [conditional-access-automation](https://github.com/judeper/FSI-AgentGov-Solutions/tree/main/conditional-access-automation) provides PowerShell deployment scripts, Azure Automation runbook wrappers, and Power Automate flow definitions.

---

## Implementation Playbooks

!!! info "Step-by-Step Implementation"

    This control has detailed playbooks for implementation, automation, testing, and troubleshooting:

    - [Portal Walkthrough](../../playbooks/control-implementations/1.23/portal-walkthrough.md) — Step-by-step portal configuration
    - [PowerShell Setup](../../playbooks/control-implementations/1.23/powershell-setup.md) — Automation scripts
    - [Verification & Testing](../../playbooks/control-implementations/1.23/verification-testing.md) — Test cases and evidence collection
    - [Troubleshooting](../../playbooks/control-implementations/1.23/troubleshooting.md) — Common issues and resolutions

---

## Verification Criteria

Confirm control effectiveness by verifying:

1. Agent access without baseline MFA is denied at sign-in (validates 1.11 dependency before step-up applies)
2. A sensitive action (`c1`) attempted more than 15 minutes after the last interactive authentication triggers a re-authentication prompt
3. Step-up using FIDO2, Windows Hello for Business, passkey, or certificate-based authentication succeeds for `c1`–`c4`
4. Step-up using SMS, voice, or password-only is denied when the policy requires the **Phishing-resistant MFA** Authentication Strength
5. Sign-in logs in Entra (Monitoring → Sign-in logs → Authentication Details) show the requested authentication context, the satisfied authentication methods, and the policy that enforced step-up
6. Sign-in risk *medium* or above triggers step-up even when no authentication context is invoked
7. PIM activation for any role in the agent governance set (Power Platform Admin, Environment Admin, AI Administrator, Purview Data Security AI Admin) requires approval, justification, and MFA on activation
8. Service principal sensitive operations are governed by an approval workflow or workload identity Conditional Access policy — no SP is silently exempt
9. Step-up failures and Conditional Access policy state changes generate alerts in Sentinel or Defender XDR within the documented SLA
10. Evidence exports (sign-in logs, CA policy snapshots, PIM activation history) are retained for the FINRA / SEC retention window applicable to the workload

---

## Additional Resources

- [Microsoft Learn: Conditional Access authentication context](https://learn.microsoft.com/entra/identity/conditional-access/concept-conditional-access-cloud-apps#authentication-context)
- [Microsoft Learn: Configure authentication context](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-cloud-apps)
- [Microsoft Learn: Conditional Access authentication strengths](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-strengths)
- [Microsoft Learn: Configure adaptive session lifetime policies (sign-in frequency)](https://learn.microsoft.com/entra/identity/conditional-access/howto-conditional-access-session-lifetime)
- [Microsoft Learn: Sign-in risk and user risk policies (Identity Protection)](https://learn.microsoft.com/entra/id-protection/howto-identity-protection-configure-risk-policies)
- [Microsoft Learn: Phishing-resistant passwordless authentication options](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-passwordless)
- [Microsoft Learn: FIDO2 security key authentication](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-passwordless#fido2-security-keys)
- [Microsoft Learn: Privileged Identity Management — configure role settings](https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-how-to-change-default-settings)
- [Microsoft Learn: Conditional Access for workload identities](https://learn.microsoft.com/entra/identity/conditional-access/workload-identity)
- [NIST SP 800-63B: Digital Identity Guidelines (Authentication)](https://pages.nist.gov/800-63-3/sp800-63b.html)
- [NIST SP 800-53 Rev. 5: IA-2 Identification and Authentication](https://csrc.nist.gov/projects/risk-management/sp800-53-controls/release-search#!/control?version=5.1&number=IA-2)
- [NYDFS 23 NYCRR 500.12: Multi-Factor Authentication](https://www.dfs.ny.gov/industry_guidance/cybersecurity)

---

*Updated: May 2026 | Version: v1.6.2 | UI Verification Status: Current*
