Check ID:
Provider: Microsoft 365
Service:
Severity: HIGH
Categories:
Resource type:
entra_users_mfa_capableProvider: Microsoft 365
Service:
entraSeverity: HIGH
Categories:
identity-access, e3Resource type:
NotDefinedWhat this check verifies
Microsoft Entra users have a registered and enabled multifactor authentication method (MFA capable). The evaluation targets enabled accounts and identifies those lacking any usable second factor.
Risk
Without MFA, accounts are vulnerable to phishing, password spraying, and credential reuse, enabling takeover. Attackers can access mail and files, change settings, and move laterally, harming confidentiality, integrity, and availability of M365 resources.Recommendation
Enforce MFA for all enabled users, prioritizing phishing-resistant methods (FIDO2/passkeys/CBA) and limiting SMS/voice. Apply least privilege and require MFA for privileged roles. Require registration during onboarding and routinely review coverage to sustain defense-in-depth.
Remediation
- CLI
- Dashboard steps
New-MgUserAuthenticationPhoneMethod -UserId <USER_UPN> -PhoneType mobile -PhoneNumber “+15555550100”
References
- https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-userdevicesettings
- https://www.cisa.gov/resources-tools/services/m365-entra-id
- https://azure.microsofts.workers.dev/en-us/entra/identity/authentication/howto-mfa-userstates
- https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mfa-howitworks
Where this check fires
This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable byCheck ID = entra_users_mfa_capable. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks