Authentication

Nothing gets access before proving what it is.

Users [a], processes acting on behalf of users [b], and devices [c] each authenticate before the system lets them in. For users and service accounts a modern directory does this by default. Your work is confirming that no path around it exists.

Hunt down default credentials before an assessor does.

Network gear, printers, cameras, and appliances ship with published usernames and passwords, and those credentials are easily found in a search. Change them at deployment, and put that step in the provisioning procedure so the practice is documented rather than remembered.

Devices authenticate through domain join or enrollment. Verification covers the fixed fleet.

The requirement says authenticated or verified. Devices joined to the domain or enrolled in Intune attest their identity when they connect, which satisfies [c]. A small office can verify instead, but the verification has to happen before access. Pair a maintained inventory of known devices with a gate that admits only inventoried devices, at fixed locations in a controlled area. Remote devices get real authentication, because no one can walk over and verify them.

Service accounts authenticate too, and the record of them is what you show.

A script or integration signs in with a credential, a certificate, or a token. Keep the IA.L2-3.5.1 service account list annotated with how each one authenticates. That record answers [b] and pays for itself again during log review and incident response.

Cloud-only does not remove the endpoints.

CUI (Controlled Unclassified Information) comes down from the cloud onto laptops for editing, printing, and building new documents. Those endpoints and their users authenticate like everything else. Moving the data to the cloud moves none of this requirement away.