Check ID: entra_users_mfa_enabled
Provider: Microsoft 365
Service: entra
Severity: CRITICAL
Categories: identity-access, e3
Resource type: NotDefined

​
What this check verifies

Microsoft Entra Conditional Access has an enforced policy requiring multifactor authentication for All users across All cloud apps (not just report-only).

​
Risk

Lacking an enforced, tenant-wide MFA mandate enables single-factor sign-ins to M365 apps. Stolen or sprayed passwords can yield access, leading to data exfiltration, unauthorized changes, and outages. Report-only or scoped policies leave gaps that undermine confidentiality, integrity, and availability.

​
Recommendation

Enforce a Conditional Access policy requiring MFA for All users and All cloud apps. Exclude only break-glass accounts, favor phishing-resistant or authenticator methods, and avoid long-term report-only. Monitor sign-ins, review coverage regularly, and apply least privilege and zero trust to minimize exceptions.

​
Remediation

resource "azuread_conditional_access_policy" "<example_resource_name>" {
  display_name = "<example_resource_name>"
  state        = "enabled" # Critical: enforce policy (not report-only)

  conditions {
    users {
      included_users = ["All"] # Critical: target all users
    }
    applications {
      included_applications = ["All"] # Critical: target all cloud apps/resources
    }
  }

  grant_controls {
    built_in_controls = ["mfa"] # Critical: require multifactor authentication
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_users_mfa_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks