Description:

Requiring Multi-Factor Authentication (MFA) for accessing privileged Virtual Machines (VMs) ensures that only users who have completed MFA registration can access critical systems. MFA provides an additional layer of security, protecting the VMs from unauthorized access, even if an account's password is compromised.

Rationale:

Requiring MFA for privileged VM access helps mitigate the risks associated with stolen credentials, weak passwords, or brute-force attacks. MFA is a proven method to ensure that only authorized users can access sensitive systems, making it a critical component of a strong security posture, particularly for systems hosting sensitive data or applications.

Impact:

Implementing MFA for privileged VM access ensures stronger security but may introduce some administrative overhead to ensure all users are registered for MFA. Additionally, users may experience slight delays during login due to the MFA challenge, although this is a small trade-off for enhanced security.

Default Value:

By default, Azure Virtual Machines do not require Multi-Factor Authentication (MFA) for access. MFA must be configured manually to restrict access.

Pre-requisites:

  • Azure account with Azure Active Directory (AAD) enabled for user authentication.

  • MFA enabled in Azure Active Directory.

  • A user must have Global Admin or Conditional Access Admin privileges to configure MFA enforcement for privileged VMs.

  • Privileged VM configured in Azure (for example, using Azure Bastion, RDP, or SSH access).

Audit:

  1. Sign in to Azure portal as a Global Admin or Conditional Access Admin.

  2. Navigate to Azure Active Directory (AAD) and review the Conditional Access Policies for MFA enforcement.

  3. Verify that MFA is required for all privileged access to VMs by checking the Conditional Access Policies applied to privileged groups or users.

Implementation Steps (Manual):

  1. Sign in to Azure portal:

    • Use an account with Global Admin or Conditional Access Admin privileges.

  2. Enable MFA for All Users (if not already done):

    • Go to Azure Active Directory > Security > MFA.

    • Ensure that MFA is enabled for all users or specific user groups (e.g., Privileged Users or Admins).

  3. Create a Conditional Access Policy for MFA Enforcement:

    • In the Azure portal, go to Azure Active Directory > Security > Conditional Access.

    • Click on + New policy to create a new Conditional Access policy.

    • Name the policy (e.g., "MFA for Privileged VM Access").

  4. Define Policy Scope:

    • Under Assignments > Users and groups, choose the user groups or individuals who require MFA for VM access (e.g., Privileged Admins, VM Admins).

    • Under Cloud apps or actions, select All Cloud Apps or specifically target Azure Virtual Machines (if accessible through a specific app).

    • Under Conditions, you can refine the policy further (e.g., target locations or device platforms if needed).

  5. Configure the Policy to Require MFA:

    • Under Access controls, select Grant > Grant access and check the box for Require multi-factor authentication.

    • This ensures that users must complete MFA verification before they can access the VM.

  6. Enable the Policy:

    • After configuring the conditions, select Enable policy to turn it on.

  7. Configure Privileged VM Access Using Azure Bastion or RDP/SSH:

    • If using Azure Bastion to access VMs, ensure that the Bastion service is configured for Azure AD authentication.

    • For RDP/SSH access, ensure that only MFA-enabled accounts can access the VMs through Conditional Access.

  8. Test the Configuration:

    • Test the VM access by attempting to log in with a privileged account that has MFA enabled and checking that MFA is prompted during the login process.

    • Ensure that users who have not enabled MFA are denied access.

  9. Monitor and Audit:

    • Use Azure AD Sign-in Logs to monitor the MFA authentication events for access to the privileged VMs.

    • Review the logs regularly to ensure compliance and detect any failed login attempts.

Backout Plan (Manual):

  1. Sign in to Azure portal:

    • Use an account with Global Admin or Conditional Access Admin privileges.

  2. Remove Conditional Access Policy:

    • Go to Azure Active Directory > Security > Conditional Access.

    • Locate the policy you created for MFA enforcement and disable or delete it.

  3. Verify Reverted Access:

    • Test that users who were previously required to use MFA can access the VM without MFA (assuming the policy was removed).

  4. Revert any additional configurations:

    • If you made any other changes to VM access methods (e.g., configuring Azure Bastion for Azure AD login), revert those configurations back to the original state.

References: