Detections
Analytics

1.1.2 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Privileged Users

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Enable multi-factor authentication for all roles, groups, and users that have write access or permissions to Azure resources. These include custom created objects or built-in roles such as;

Service Co-Administrators

Subscription Owners

Contributors

Rationale:

Multi-factor authentication requires an individual to present a minimum of two separate forms of authentication before access is granted. Multi-factor authentication provides additional assurance that the individual attempting to gain access is who they claim to be. With multi-factor authentication, an attacker would need to compromise at least two different authentication mechanisms, increasing the difficulty of compromise and thus reducing the risk.

Impact:

Users would require two forms of authentication before any access is granted. Additional administrative time will be required for managing dual forms of authentication when enabling multi-factor authentication.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

From Azure Portal

From Azure Home select the Portal Menu

Select Azure Active Directory blade

Then Users

Select All Users

Click on the Per-User MFA button in the top row menu

Select each user individually with the role Service Co-Administrators, Owners, OR Contributors in the column MULTI-FACTOR AUTH STATUS

In the information box on the right side under the title quick steps click enable

Other Options within Azure Portal
Follow Microsoft Azure documentation and enable multi-factor authentication in your environment.
https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-azure-mfa
Enabling and configuring MFA with conditional access policy is a multi-step process. Here are some additional resources on the process within Azure AD to enable multi-factor authentication for users within your subscriptions with conditional access policy.
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-getstarted#enable-multi-factor-authentication-with-conditional-access
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings
Please note that at the time of writing, there is no API, Azure CLI or Powershell mechanism available to programmatically conduct security assessment or remediation for this recommendation. The only option is MSOL.

Default Value:

By default, multi-factor authentication is disabled for all users.

See Also

https://workbench.cisecurity.org/files/4052

Item Details

References: CSCv7|4.5, CSCv7|16.3

Plugin: microsoft_azure

Control ID: b143f75a7a5940911eb2b6576b4e9c4fec34af732ed4d3aa639c188e712045a2