# Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Privileged Users

- Source: https://support.icompaas.com/support/solutions/articles/62000219679-ensure-that-multi-factor-auth-status-is-enabled-for-all-privileged-users
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure CIS Benchmark Level 1 & Level 2](https://support.icompaas.com/support/solutions/62000112163) › [1. Identity and Access Management](https://support.icompaas.com/support/solutions/folders/62000167544)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## **Description:**

Enable multi-factor authentication for all user credentials who have write access to Azure resources. These include roles like

-   Service Co-Administrators
    
-   Subscription Owners
    
-   Contributors
    

  

## **Rationale:**

Multi-factor authentication requires an individual to present a minimum of two separate forms of authentication before access is granted. With multi-factor authentication, an attacker would need to compromise at least two different authentication mechanisms, increasing the difficulty of compromise and thus reducing the risk.

  

## **Impact:**

Users would require two forms of authentication before any action is granted. Also, this requires overhead for managing dual forms of authentication.

  

## **Default Value:**

By default, multi-factor authentication is disabled for all users.

  

## **Audit:**

From Azure Console

1.  After Signing in to your azure account from Azure Console.
    
2.  Go to **Azure Active Directory**
    
3.  Go to **Users**
    
4.  Go to **All Users**
    
5.  Click on **Per-user MFA(Multi-Factor Authentication)** button on the top bar
    
      
    
6.  Check that **MULTI-FACTOR AUTH STATUS** is Enabled for all users who are Service Co-Administrators OR Owners OR Contributors.  
    ![](https://support.icompaas.com/assets/kb/0d219e8d56357509.png)

  

## **Remediation:**

### Pre-Requisite:

1.  A working Azure AD tenant with at least an Azure AD Premium P1 or trial license enabled.
    
2.  An account with global administrator privileges.
    

  

### Implementation Steps:

1.  Go to **Azure Active Directory**  
    **![](https://support.icompaas.com/assets/kb/387f6d729d490750.png)**
    
2.  Go to **Users**  
    **![](https://support.icompaas.com/assets/kb/c224887521745656.png)**
    
3.  Go to **All Users**  
    **![](https://support.icompaas.com/assets/kb/98858a7a6f238bb1.png)**
    
4.  Click on **Per-user MFA(Multi-Factor Authentication)** button on the top bar  
    ![](https://support.icompaas.com/assets/kb/cd1bb5477bba7852.png)
    
      
    
5.  Select the user, click on Enable, and in the popup, Click on **ENABLE MULTI-FACTOR AUTH**  to enable MFA   
    ![](https://support.icompaas.com/assets/kb/6a912f18ca8f24ac.png) 
    

  

### Backout Plan:

1.  Go to Azure Active Directory
    
2.  Go to Users
    
3.  Go to All Users
    
4.  Click on Multi-Factor Authentication button on the top bar
    
5.  Select the user, click on Disable, to disable MFA 
    

  

## **Microsoft Graph API**

  
For Every Subscription, For Every Tenant  
Step 1: Identify Users with Administrative Access

1.  List All Users Using Microsoft Graph API:  
      
    
    GET https://graph.microsoft.com/v1.0/users Capture id and corresponding userPrincipalName ($uid, $userPrincipalName)
    
2.  List all Role Definitions Using Azure management API:  
    
    https://management.azure.com/subscriptions/:subscriptionId/providers/Microsoft.Authorization/roleDefinitions?api-version=2017-05-01Capture Role Definition IDs/Name ($name) and role names ($properties/roleName) where"properties/roleName" contains (Owner or \*contributor or admin )
    
3.  List All Role Assignments (Mappings $A.uid to $[B.name](http://b.name/ "http://B.name")) Using Azure Management  
    API:  
    
    GET
    https://management.azure.com/subscriptions/:subscriptionId/providers/Microsoft.Authorization/roleassignments?api-version=2017-10-01-preview
    
    Find all administrative roles ($[B.name](http://b.name/ "http://B.name")) in "Properties/roleDefinitionId" mapped with  
    user ids ($[A.id](http://a.id/ "http://A.id")) in "Properties/principalId" where "Properties/principalType" ==  
    "User"
    
4.  Now Match ($CProperties/principalId) with $A.uid and get  
    $A.userPrincipalName save this as D.userPrincipalName  
    Step 2: Run MSOL Powershell command:  
    
    Get-MsolUser -All | where {$\_.StrongAuthenticationMethods.Count -eq 0} |Select-Object -Property UserPrincipalName
    
    If the output contains any of the $D.userPrincipalName, then this recommendation is non-  
    compliant.
    
      
    
      
    
    ## **Note:**
    
    Please note that at this point of time, there is no API/CLI mechanism available to programmatically conduct a security assessment for this recommendation. The only option is MSOL.  
      
    
    ## **Reference:**
    
    1.  **[](https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication "https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication")**[](https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication "https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication")[https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor- authentication](https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication "https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication")
        
    2.  [https://stackoverflow.com/questions/41156206/azure-active-directory-premium- mfa-attributes-via-graph-api](https://stackoverflow.com/questions/41156206/azure-active-directory-premium-mfa-attributes-via-graph-api "https://stackoverflow.com/questions/41156206/azure-active-directory-premium-mfa-attributes-via-graph-api")
        
    3.  [https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls- v2-identity-management#im-4-use-strong-authentication-controls-for-all-azure- active-directory-based-access](https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-identity-management#im-4-use-strong-authentication-controls-for-all-azure-active-directory-based-access "https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-identity-management#im-4-use-strong-authentication-controls-for-all-azure-active-directory-based-access")

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.