Check ID: organizations_mfa_required
Provider: MongoDB Atlas
Service: organizations
Severity: HIGH
Categories: identity-access
Resource type: NotDefined

​
What this check verifies

MongoDB Atlas organization mandates multi-factor authentication for all members before accessing organization resources (multi_factor_auth_required).

​
Risk

Without enforced MFA, compromised passwords can grant organization access, enabling:
  • Data exposure (confidentiality)
  • Unauthorized configuration or role changes (integrity)
  • Resource deletion or disruption (availability) Increases success of phishing, brute force, and session takeover.

​
Recommendation

Enforce org-wide MFA (multi_factor_auth_required). Prefer phishing-resistant factors (security keys/biometrics) over SMS, and require at least two methods for recovery. Integrate with SSO, apply least privilege, and block access until all users enroll.

​
Remediation

curl --digest -u "<PUBLIC_KEY>:<PRIVATE_KEY>" -H "Content-Type: application/json" -X PATCH "https://cloud.mongodb.com/api/atlas/v2/orgs/<example_resource_id>" -d '{"multiFactorAuthRequired":true}'

​
References

​
Where this check fires

This check runs on every scheduled scan against your MongoDB Atlas account. Findings appear at Cloud Security → Findings filterable by Check ID = organizations_mfa_required. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to MongoDB Atlas checks