Check ID: identity_user_mfa_enabled_console_access
Provider: Oracle Cloud (OCI)
Service: identity
Severity: HIGH
Categories: identity-access
Resource type: User

​
What this check verifies

OCI IAM users with console password access are expected to have multifactor authentication enabled. The evaluation inspects each local user allowed to sign in to the Console and identifies those without an active second factor.

​
Risk

Console-password accounts without MFA are exposed to phishing, credential stuffing, and brute force. A stolen password can grant Console access, enabling privilege escalation, key creation, and data access-compromising confidentiality, integrity, and availability across OCI.

​
Recommendation

Require MFA for all users with Console passwords; prefer phishing-resistant authenticators (e.g., FIDO). Enforce via sign-on policies, prioritizing admins. Apply least privilege, disable Console passwords for service or federated users, and monitor auth logs to confirm ongoing MFA coverage.

​
Remediation

oci iam user update-user-capabilities —user-id <USER_OCID> —can-use-console-password false

​
References

​
Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = identity_user_mfa_enabled_console_access. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Oracle Cloud (OCI) checks