Microsoft Entra IDOverview
Designated users will be prompted to use their multi-factor authentication (MFA) process upon login.
Rationale
Enabling multi-factor authentication is a recommended setting to limit the potential for accounts to be compromised and to limit access to authenticated personnel.
Impact
Risk-based conditional access requires Microsoft Entra ID P2, which increases the cost. Similarly, it may require additional overhead to maintain if users lose access to their MFA.
Default Value
MFA is not enabled by default.
Remediation guidance
From Azure Portal
- Open Conditional Access | Policies.
- Click
+ New policy. - Enter a name for the policy.
- Select
Users. - Under
Include, selectAll users. - Under
Exclude, checkUsers and groups. - Select users this policy should not apply to and click Select.
- Under
Target resources, selectCloud apps`. - Select
All cloud apps. - Select
Conditions. - Select
Sign-in risk. - Update the
Configuretoggle toYes. - Check the sign-in risk level this policy should apply to, e.g.,
HighandMedium. - Select
Done. - Click the blue text under
Grant access, checkRequire multifactor authentication, then click theSelectbutton. - Click the blue text under Session, then check Sign-in frequency, select
Every time, and click theSelectbutton. - Set
Enable policytoReport-only. - Click
Create.
After testing the policy in report-only mode, update the Enable policy setting from Report-only to On.
Multiple Remediation Paths
SERVICE-WIDE (RECOMMENDED when many resources are affected): Apply organization/tenant-level guardrails and baseline policies for the entire platform.
ASSET-LEVEL: Fix only the affected resources identified by this control.
PREVENTIVE: Add preventive policy checks to CI/CD and periodic posture scans.
References for Service-Wide Patterns
- Platform policy/governance and preventive control patterns should be applied tenant-wide where supported.
Query logic
These are the stored checks tied to this control.
Entra Conditional Access - MFA for Risky Sign-Ins
Connectors
Covered asset types
Expected check: eq []
{
connectors(
where: {
conditionalAccessPolicies_NONE: {
conditions: {
includeUsers: ["All"]
NOT: { excludeUsers: [] }
includeApplications: ["All"]
clientAppTypes: ["all"]
signInRiskLevels_INCLUDES: "high"
}
grantControls: { builtInControls: ["mfa"] }
sessionControls: {
signInFrequencyIsEnabled: true
signInFrequencyInterval: "everytime"
}
}
}
) {
...AssetFragment
}
}
