Check ID: entra_user_with_vm_access_has_mfa
Provider: Azure
Service: entra
Severity: HIGH
Categories: identity-access, e3
Resource type: NotDefined

​
What this check verifies

Microsoft Entra users with Azure roles that grant VM sign-in or management access-such as Owner, Contributor, Virtual Machine * Login, and Virtual Machine Contributor-are evaluated for multi-factor authentication enrollment. The finding highlights accounts with VM access that lack more than one authentication factor.

​
Risk

Without MFA, accounts with VM access are vulnerable to phishing, password spraying, and credential stuffing. Compromise can enable remote VM login, abuse of the VM’s managed identity, privilege escalation, and lateral movement-impacting confidentiality, integrity, and availability of workloads.

​
Recommendation

Enforce MFA for all identities that can sign in to or manage VMs via Conditional Access, preferring strong, phishing-resistant methods. Apply least privilege by removing broad roles (Owner, Contributor) when not required. Use PIM/JIT for admin access and monitor sign-in risk for continuous assurance.

​
Remediation

az rest --method post --url https://graph.microsoft.com/v1.0/users/<example_user_id>/authentication/phoneMethods --body '{"phoneNumber":"+10000000000","phoneType":"mobile"}'

​
References

​
Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_user_with_vm_access_has_mfa. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks