Microsoft Entra IDOverview
Designated users will be prompted to use their multi-factor authentication (MFA) process upon login.
Rationale
Enabling multi-factor authentication is a recommended setting to limit the use of Administrative accounts to authenticated personnel.
Impact
There is an increased cost, as Conditional Access policies require Microsoft Entra ID P1. Similarly, MFA may require additional overhead to maintain. There is also a potential scenario in which the multi-factor authentication method can be lost, and administrative users are no longer able to log in. For this scenario, there should be an emergency access account. See Plan a Conditional Access deployment before deploying this.
Default Value
By default, MFA is not enabled for any administrative accounts.
Remediation guidance
From Azure Portal
- Open Conditional Access | Policies.
- Click
+ New policy. - Enter a name for the policy.
- Select
Users or workload identities. - Check
Users and groups. - Select administrative groups this policy should apply to and click
Select. - Under
Exclude, checkUsers and groups. - Select users this policy should not apply to and click
Select. - Select
Cloud apps or actions. - Select
All cloud apps. - Select
Grant. - Under Grant access, check
Require multifactor authenticationand clickSelect. - Set
Enable policytoReport-only. - Click
Create.
After testing the policy in report-only mode, update the Enable policy setting from Report-only to On.
Multiple Remediation Paths
SERVICE-WIDE (RECOMMENDED when many resources are affected): Apply organization/tenant-level guardrails and baseline policies for the entire platform.
ASSET-LEVEL: Fix only the affected resources identified by this control.
PREVENTIVE: Add preventive policy checks to CI/CD and periodic posture scans.
References for Service-Wide Patterns
- Platform policy/governance and preventive control patterns should be applied tenant-wide where supported.
Query logic
These are the stored checks tied to this control.
Entra Conditional Access Policies - Admin MFA
Connectors
Covered asset types
Expected check: eq []
{
connectors(
where: {
cloudProvider: "entra"
conditionalAccessPolicies_NONE: {
conditions: {
NOT: {
excludeUsers: []
OR: { includeUsers: [], includeGroups: [], includeRoles: [] }
}
includeApplications: ["All"]
clientAppTypes: ["all"]
}
grantControls: { builtInControls: ["mfa"] }
}
}
) {
...AssetFragment
}
}
