Skip to main content

📝 Microsoft Entra ID Privileged User Multi-Factor Auth Status is not enabled 🟢

  • Contextual name: 📝 Privileged Users Multi-Factor Auth Status is not enabled 🟢
  • ID: /ce/ca/azure/microsoft-entra-id/privileged-users-multi-factor-auth-status
  • Located in: 📁 Microsoft Entra ID

Flags​

Our Metadata​

  • Policy Type: COMPLIANCE_POLICY
  • Policy Category:
    • SECURITY

Similar Policies​

Description​

Open File

Description​

[IMPORTANT - Please read the section overview: If your organization pays for Microsoft Entra ID licensing (included in Microsoft 365 E3, E5, or F5, and EM&S E3 or E5 licenses) and CAN use Conditional Access, ignore the recommendations in this section and proceed to the Conditional Access section.]

Enable multi-factor authentication for all roles, groups, and users that have write access or permissions to Azure resources. These include custom created objects or built-in roles such as:

  • Service Co-Administrators
  • Subscription Owners
  • Contributors

Rationale​

Multi-factor authentication requires an individual to present a minimum of two separate forms of authentication before access is granted. Multi-factor authentication provides additional assurance that the individual attempting to gain access is who they claim to be. With multi-factor authentication, an attacker would need to compromise at least two different authentication mechanisms, increasing the difficulty of compromise and thus reducing the risk.

... see more

Remediation​

Open File

Remediation​

From Azure Portal​

  1. From Azure Home select the Portal Menu.
  2. Select Microsoft Entra ID blade.
  3. Under Manage, click Roles and administrators.
  4. Take note of all users with the role Service Co-Administrators, Owners or Contributors.
  5. Return to the Overview.
  6. Under Manage, click Users.
  7. Click on the Per-User MFA button in the top row menu.
  8. Check the box next to each noted user.
  9. Click Enable MFA.
  10. Click Enable.

Other Options within Azure Portal​

Follow Microsoft Azure documentation and enable multi-factor authentication in your environment.

Enabling and configuring MFA with conditional access policy is a multi-step process. Here are some additional resources on the process within Entra ID to enable multi-factor authentication for users within your subscriptions with conditional access policy.

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 CIS Azure v2.1.0 → 💼 1.1.2 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Privileged Users - Level 1 (Manual)1
💼 CIS Azure v3.0.0 → 💼 2.1.2 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Privileged Users (Manual)1
💼 Cloudaware Framework → 💼 Multi-Factor Authentication (MFA) Implementation16