Skip to main content

📝 Privileged Azure Virtual Machine is accessed by identities without MFA 🟢

  • Contextual name: 📝 Privileged Virtual Machine is accessed by identities without MFA 🟢
  • ID: /ce/ca/azure/virtual-machine/privileged-virtual-machine-access-mfa-identity-only
  • Located in: 📁 Azure Virtual Machines

Flags​

Our Metadata​

  • Policy Type: COMPLIANCE_POLICY
  • Policy Category:
    • SECURITY

Description​

Open File

Description​

Verify identities without MFA that can log in to a privileged virtual machine using separate login credentials. An adversary can leverage the access to move laterally and perform actions with the virtual machine's managed identity. Make sure the virtual machine only has necessary permissions, and revoke the admin-level permissions according to the least privileges principal

Rationale​

Integrating multi-factor authentication (MFA) as part of the organizational policy can greatly reduce the risk of an identity gaining control of valid credentials that may be used for additional tactics such as initial access, lateral movement, and collecting information. MFA can also be used to restrict access to cloud resources and APIs.

An Adversary may log into accessible cloud services within a compromised environment using Valid Accounts that are synchronized to move laterally and perform actions with the virtual machine's managed identity. The adversary may then perform management actions or access cloud-hosted resources as the logged-on managed identity.

... see more

Remediation​

Open File

Remediation​

From Azure Portal​

  1. Log in to the Azure portal.

  2. This can be remediated by enabling MFA for user, Removing user access or Reducing access of managed identities attached to virtual machines.

  • Case I : Enable MFA for users having access on virtual machines.
    1. Navigate to Azure AD from the left pane and select Users from the Manage section.
    2. Click on Per-User MFA from the top menu options and select each user with MULTI-FACTOR AUTH STATUS as Disabled and can login to virtual machines:
      • From quick steps on the right side select enable.
      • Click on enable multi-factor auth and share the link with the user to setup MFA as required.
  • Case II : Removing user access on a virtual machine.
    1. Select the Subscription, then click on Access control (IAM).
    2. Select Role assignments and search for Virtual Machine Administrator Login or Virtual Machine User Login or any role that provides access to log into virtual machines.
    3. Click on Role Name, Select Assignments, and remove identities with no MFA configured.

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 CIS Azure v2.1.0 → 💼 7.8 Ensure only MFA enabled identities can access privileged Virtual Machine - Level 2 (Automated)1
💼 CIS Azure v3.0.0 → 💼 8.10 Ensure only MFA enabled identities can access privileged Virtual Machine (Manual)1
💼 Cloudaware Framework → 💼 Multi-Factor Authentication (MFA) Implementation16