Detections
Analytics

5.2.4.2 Ensure that 2 methods are required for password reset

Information

Ensures that two alternate forms of identification are provided before allowing a password reset.

The recommended state is Number of methods required to reset set to 2.

Requiring Multi-factor Authentication (MFA) for Self-service Password Reset (SSPR) strengthens the password reset process by confirming the user's identity with two separate methods of authentication. With multiple methods required for password reset, an attacker would have to compromise multiple authentication methods before resetting a user's password.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

To remediate using the UI:

 - Navigate to Microsoft Entra admin center https://entra.microsoft.com/.
 - Expand Entra ID > Password reset and select Authentication methods.
 - Set the Number of methods required to reset to 2
 - Click Save

Impact:

If multiple methods are required for password reset and a user has lost access to other authentication methods, the resetting user will need an administrator with permissions to remove the lost authentication method. Policy and training are recommended to teach administrators to verify the identity of the requesting user so that social engineering is not an effective vector of compromise.

If multifactor authentication is not currently enabled for all users, users with only one registered form of authentication will not be able to reset their passwords through SSPR until another form of authentication is registered.

If multifactor authentication is already enabled for all users, the impact of this recommendation should be minimal.

See Also

https://workbench.cisecurity.org/benchmarks/24620

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-2(1), 800-53|IA-2(2), CSCv7|16.3

Plugin: microsoft_azure

Control ID: 86fd8ba83ac8df756999573da8a6f7139de0ca9481072596c6c7fb2f38b7354d