Privileged user has multi-factor authentication enabled

Check ID: entra_privileged_user_has_mfa
Provider: Azure
Service: entra
Severity: HIGH
Categories: identity-access, e3
Resource type: NotDefined

What this check verifies

Microsoft Entra privileged accounts are expected to use multifactor authentication. This evaluates users assigned to elevated directory roles and confirms they have multiple authentication methods registered for sign-in.

Risk

Without MFA, privileged accounts face phishing, password spraying, and credential reuse risks. Compromise can grant tenant-wide admin control to alter roles, create backdoors, exfiltrate data, and weaken defenses, impacting confidentiality, integrity, and availability.

Recommendation

Enforce MFA for all privileged roles via Conditional Access or security defaults. Prefer phishing-resistant methods (FIDO2, passkeys, Authenticator push) over SMS/voice. Require registration before granting privileges, block legacy/basic auth, and apply least privilege with protected break-glass accounts.

Remediation

CLI
Terraform
Dashboard steps

az rest --method post --url https://graph.microsoft.com/v1.0/users/<example_resource_id>/authentication/phoneMethods --body '{"phoneNumber":"+10000000000","phoneType":"mobile"}'

resource "azuread_conditional_access_policy" "<example_resource_name>" {
  display_name = "<example_resource_name>"
  state        = "enabled"

  conditions {
    users {
      included_roles = ["<example_role_template_id>"]  # Critical: targets privileged role(s)
    }
    applications {
      included_applications = ["All"]
    }
  }

  grant_controls {
    operator            = "OR"
    built_in_controls   = ["mfa"]  # Critical: requires MFA to access
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_privileged_user_has_mfa. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Users cannot consent to non-verified applications Microsoft Entra ID tenant has Security Defaults enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires