1.1.3 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Non-Privileged Users - List Users

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version


Enable multi-factor authentication for all non-privileged users.


Multi-factor authentication requires an individual to present a minimum of two separate forms of authentication before access is granted. Multi-factor authentication provides additional assurance that the individual attempting to gain access is who they claim to be. With multi-factor authentication, an attacker would need to compromise at least two different authentication mechanisms, increasing the difficulty of compromise and thus reducing the risk.


Users would require two forms of authentication before any access is granted. Also, this requires an overhead for managing dual forms of authentication.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.


Follow Microsoft Azure documentation and enable multi-factor authentication in your environment.
Enabling and configuring MFA is a multi-step process. Here are some additional resources on the process within Azure AD:

Default Value:

By default, multi-factor authentication is disabled for all users.

See Also