Microsoft Entra IDOverview
Designated users will be prompted to use their multi-factor authentication (MFA) process upon login.
Rationale
Enabling multi-factor authentication is a recommended setting to limit the potential for accounts to be compromised and to limit access to authenticated personnel.
Impact
Conditional Access policies require Microsoft Entra ID P1 or P2, which increases the cost. Similarly, if users lose access to their MFA, this may require additional overhead to maintain.
Default Value
MFA is not enabled by default.
Remediation guidance
From Azure Portal
- Open Conditional Access | Policies.
- Click
+ New policy. - Enter a name for the policy.
- Select
Users. - Under
Include, selectAll users. - Under
Exclude, checkUsers and groups. - Select users this policy should not apply to and click
Select. - Under
Target resources, selectCloud apps. - Select
All cloud apps. - Select
Grant. - Under
Grant access, checkRequire multifactor authenticationand clickSelect. - Set
Enable policytoReport-only. - Click
Create.
After testing the policy in report-only mode, update the Enable policy setting from Report-only to On.
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Microsoft Entra ID
Use tenant-wide Conditional Access, role settings, authentication policies, and identity governance baselines so the control is enforced centrally.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
Entra Conditional Access Policies - MFA For All Users
Connectors
Covered asset types
Expected check: eq []
{
connectors(
where: {
conditionalAccessPolicies_NONE: {
conditions: {
includeUsers: ["All"]
NOT: { excludeUsers: [] }
includeApplications: ["All"]
clientAppTypes: ["all"]
}
grantControls: { builtInControls: ["mfa"] }
}
}
) {
...AssetFragment
}
}
