1.2.6 Ensure Multi-factor Authentication is Required for Azure Management

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

For designated users, they will be prompted to use their multi-factor authentication (MFA) process on logins.

Rationale:

Enabling multi-factor authentication is a recommended setting to limit the use of Administrative actions and to prevent intruders from changing settings.

Impact:

There is an increased cost, as Conditional Access policies require Azure AD Premium. Similarly, they may require additional overhead to maintain if users lose access to their MFA.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

From Azure Portal

From Azure Home select the Portal Menu and select Azure Active Directory.

Scroll down in the menu on the left, and select Security.

Select on the left side Conditional Access.

Click the + New policy

Default Value:

MFA is not enabled by default for administrative actions.

See Also

https://workbench.cisecurity.org/files/4052