Information
For designated users, they will be prompted to use their multi-factor authentication (MFA) process on logins.
Rationale:
Enabling multi-factor authentication is a recommended setting to limit the use of Administrative actions and to prevent intruders from changing settings.
Impact:
There is an increased cost, as Conditional Access policies require Azure AD Premium. Similarly, they may require additional overhead to maintain if users lose access to their MFA.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
From Azure Portal
From Azure Home select the Portal Menu and select Azure Active Directory.
Scroll down in the menu on the left, and select Security.
Select on the left side Conditional Access.
Click the + New policy
Default Value:
MFA is not enabled by default for administrative actions.