# Ensure Multi-factor Authentication is Required for Azure Management

- Source: https://support.icompaas.com/support/solutions/articles/62000229786-ensure-multi-factor-authentication-is-required-for-azure-management
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [General](https://support.icompaas.com/support/solutions/62000037933) › [Azure Compliance / Control / Check](https://support.icompaas.com/support/solutions/folders/62000168797)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

Ensure Multi-Factor Authentication (MFA) is required for Azure management access by enforcing MFA through Microsoft Entra ID Conditional Access. This control protects Azure management operations by requiring additional authentication for access to the Azure portal, Azure PowerShell, Azure CLI, ARM APIs, and other Azure management interfaces, reducing the risk of unauthorized administrative actions.

  

Rationale:

Without MFA enforcement on Azure management endpoints, attackers who obtain or guess a password could modify or destroy cloud resources. MFA significantly reduces the likelihood of unauthorised administrative access. This requirement aligns with zero-trust principles and security best practices, ensuring only verified users can access Azure management tools.

  

Impact:

-   Prevents unauthorised users from performing management operations
    
-   Strengthens identity protection and reduces credential-based attacks
    
-   Ensures compliance with major security frameworks (CIS, NIST, ISO, SOC2)
    

Default Value:

MFA for Azure management is not enabled by default. Conditional Access must be configured manually.

Pre-Requisites:

-   Microsoft Entra ID P1 or P2 license
    
-   Conditional Access permissions (Security Administrator, Global Administrator)
    
-   Cloud apps list, including Microsoft Azure Management endpoints
    

Test Plan:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/).
    
2.  Open Microsoft Entra ID
    
3.  Under the Manage section, select Security 
    
4.  Under the protect, open Conditional Access and Select Policies
    
5.  Review existing Conditional Access policies
    
6.  Verify a policy exists that targets Microsoft Azure Management and requires Multi-Factor Authentication
    
7.  Verify the policy applies to the intended users and is enabled
    
8.  If MFA is not required for Azure management access, follow the implementation steps
    

  

Implementation steps:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Open Microsoft Entra ID
    
3.  Under the Manage section, select Security
    

                                ![](https://support.icompaas.com/assets/kb/f7503b8ec0b615f1.png)

4.  Under the Protect section, open Conditional Access and select Policies
    

                               ![](https://support.icompaas.com/assets/kb/5670e54f27563a81.png)

5.  Select Create new policy
    

![](https://support.icompaas.com/assets/kb/b83fc4e02ed52f72.png)

6.  Configure Users to include the intended users
    
7.  Configure Cloud apps to target Microsoft Azure Management
    
8.  Configure Grant controls to require Multi-Factor Authentication
    
9.  Enable the policy and save the configuration
    

  

Backout Plan:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Open Microsoft Entra ID
    
3.  Under the Manage section, select Security
    
4.  Under the Protect section, open Conditional Access and select Policies
    
5.  Select the Conditional Access policy enforcing MFA for Azure management
    
6.  Disable or delete the policy
    
7.  Save the changes
    

  

Reference:

-   [https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-azure-management](https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-azure-management)
    
-   [https://learn.microsoft.com/azure/active-directory/conditional-access/overview](https://learn.microsoft.com/azure/active-directory/conditional-access/overview)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.