Detections
Analytics
2.1.2 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Privileged Users
Information
[IMPORTANT - Please read the section overview: If your organization pays for Microsoft Entra ID licensing (included in Microsoft 365 E3, E5, or F5, and EM&S E3 or E5 licenses) and CAN use Conditional Access, ignore the recommendations in this section and proceed to the Conditional Access section.]Enable multi-factor authentication for all roles, groups, and users that have write access or permissions to Azure resources. These include custom created objects or built-in roles such as;
Service Co-Administrators
Subscription Owners
Contributors
Rationale:
Multi-factor authentication requires an individual to present a minimum of two separate forms of authentication before access is granted. Multi-factor authentication provides additional assurance that the individual attempting to gain access is who they claim to be. With multi-factor authentication, an attacker would need to compromise at least two different authentication mechanisms, increasing the difficulty of compromise and thus reducing the risk.
Impact:
Users would require two forms of authentication before any access is granted. Additional administrative time will be required for managing dual forms of authentication when enabling multi-factor authentication.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
Remediate from Azure PortalFrom Azure Home select the Portal Menu
Select Microsoft Entra ID blade
Under Manage, click Roles and administrators
Take note of all users with the role Service Co-Administrators, Owners or Contributors
Return to the Overview
Under Manage, click Users
Click on the Per-User MFA button in the top row menu
Check the box next to each noted user
Click Enable MFA
Click Enable
Other Options within Azure Portal
Follow Microsoft Azure documentation and enable multi-factor authentication in your environment.
https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-azure-mfa
Enabling and configuring MFA with conditional access policy is a multi-step process. Here are some additional resources on the process within Entra ID to enable multi-factor authentication for users within your subscriptions with conditional access policy.
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-getstarted#enable-multi-factor-authentication-with-conditional-access
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings
Default Value:
By default, multi-factor authentication is disabled for all users.
See Also
Item Details
Audit Name: CIS Microsoft Azure Foundations v3.0.0 L1
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-2(1), 800-53|IA-2(2), CSCv7|4.5, CSCv7|16.3
Plugin: microsoft_azure
Control ID: 833d12c4401096486664983b408115c5314c80c681975a7058bb032eaa7895ac