Check ID: entra_non_privileged_user_has_mfa
Provider: Azure
Service: entra
Severity: MEDIUM
Categories: identity-access, e3
Resource type: NotDefined

​
What this check verifies

Microsoft Entra non-privileged users are assessed for multifactor authentication by verifying they have two or more registered authentication methods (MFA enrollment).

​
Risk

Absent MFA on standard accounts enables password-only logins after phishing, reuse, or spraying, leading to account takeover. Attackers can access email, files, and apps, send internal phishing, and escalate, undermining confidentiality and integrity, and risking availability via malicious changes.

​
Recommendation

Enforce MFA for all users, including non-privileged. Prefer phishing-resistant methods (FIDO2/passkeys or Authenticator with number matching); avoid SMS/voice when possible. Use Conditional Access to require MFA by risk and context. Pair with least privilege, device trust, and sign-in monitoring.

​
Remediation

az rest --method POST --url https://graph.microsoft.com/v1.0/users/<example_user_id>/authentication/temporaryAccessPassMethods --body '{"lifetimeInMinutes":60,"isUsableOnce":true}'

​
References

​
Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_non_privileged_user_has_mfa. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks