Conditional Access enforces MFA for the Management API

​

What this check verifies

Microsoft Entra Conditional Access is verified to have at least one enabled policy that requires multifactor authentication for the Windows Azure Service Management API, covering Azure Portal, CLI, PowerShell, and IaC tools.

​

Risk

Without MFA on Azure management endpoints, compromised credentials allow control-plane access. Attackers can modify configurations, create or delete resources, extract secrets, and pivot laterally, compromising confidentiality, integrity, and availability.

​

Recommendation

Enforce MFA via Conditional Access for the Windows Azure Service Management API scoped to all users. Prefer phishing-resistant methods, apply least privilege, and monitor sign-ins for anomalous activity. Only exclude dedicated break-glass accounts.

​

Remediation

Dashboard steps

1. In the Microsoft Entra admin center, go to Protection > Conditional Access > Policies.
2. Click New policy.
3. Under Users, select Include > All users.
4. Under Target resources, select Include > Select resources > choose “Windows Azure Service Management API”.
5. Under Grant, select Grant access > check Require multifactor authentication > Select.
6. Set Enable policy to On and click Create.

​

References

• https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-old-require-mfa-azure-mgmt
• https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-cloud-apps

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_conditional_access_policy_require_mfa_for_management_api. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks