# Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Non-Privileged Users

- Source: https://support.icompaas.com/support/solutions/articles/62000219680-ensure-that-multi-factor-auth-status-is-enabled-for-all-non-privileged-users
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure CIS Benchmark Level 1 & Level 2](https://support.icompaas.com/support/solutions/62000112163) › [1. Identity and Access Management](https://support.icompaas.com/support/solutions/folders/62000167544)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description: 

This control ensures that all non-privileged user accounts have Multi-Factor Authentication enabled to provide an additional layer of identity protection. Enabling MFA helps prevent unauthorized access by requiring a second verification method during login, significantly improving security against phishing, credential theft, and account misuse.

  

Rationale:

Non-privileged accounts are common targets for cyberattacks. Enabling MFA reduces the risk of unauthorized access by ensuring that compromised passwords alone cannot be used, helping protect corporate data and preventing attackers from gaining access to internal systems.

  

Impact:

Users will experience an extra authentication step during login, which may slightly increase sign-in time. However, this improves overall system security, reduces account compromise risk, and strengthens trust in access control mechanisms across the organization.

  

[](https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference)

Pre-requisites:

-   Global Administrator or Security Administrator access to Microsoft Entra ID
    
-   Non-privileged users exist in Microsoft Entra ID.
    

  

Test Plan:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Search for Microsoft Entra ID and open it
    
3.  Select Users under Manage
    
4.  Open Per-user MFA
    
5.  Review all non-privileged users
    

![](https://support.icompaas.com/assets/kb/9e00e37f8fa6deac.png)

6.  Verify Multi-Factor Auth Status is set to Enabled or Enforced for each non-privileged user
    
7.  If Multi-Factor Auth Status is not Enabled or Enforced, follow the implementation steps  
      
    

Implementation Steps:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Search for Microsoft Entra ID and open it
    
3.  Select Users under Manage
    

                                  ![](https://support.icompaas.com/assets/kb/fa73b3b074a058a4.png)

  

4.  Open Per-user MFA
    

                                ![](https://support.icompaas.com/assets/kb/90c5c14fb67ad1d1.png)

5.  Select the non-privileged user with Multi-Factor Auth Status set to Disabled
    

![](https://support.icompaas.com/assets/kb/1436acb0fa1a041a.png)

6.  Click Enable
    

                       ![](https://support.icompaas.com/assets/kb/52938b9eaf0ffcc7.png)

7.  Confirm the action and save
    

Backup:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/).
    
2.  Search for Microsoft Entra ID and open it
    
3.  Select Users under Manage
    
4.  Open Per-user MFA
    
5.  Select the changed non-privileged user
    
6.  Change Multi-Factor Auth Status from Enabled or Enforced to Disabled
    

References: [](https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates) 

1.  [https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates](https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates)
    
2.  [https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates#enable-and-enforce-mfa](https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates#enable-and-enforce-mfa)
    
3.  [https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference](https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.