Description: 

The 'Default to Microsoft Entra authorization in the Azure portal' setting determines whether users should be automatically directed to use Microsoft Entra (formerly Azure Active Directory) for authentication and authorization when accessing resources in the Azure portal. Enabling this setting ensures that Microsoft Entra is the default method for managing user permissions, roles, and access controls for Azure resources.

Rationale: 

Enabling Microsoft Entra as the default authorization system in the Azure portal ensures that authentication and authorization for Azure resources are consistently managed through a centralized and secure identity platform. Microsoft Entra integrates with Azure Active Directory, providing a unified and secure approach to identity and access management (IAM). This setting is crucial for ensuring consistent enforcement of security policies, including role-based access control (RBAC), MFA (Multi-Factor Authentication), and conditional access.

Impact:

 Enabling this setting helps ensure that all users and administrators are consistently authenticated using Microsoft Entra, thereby improving the security posture and simplifying access management. It also ensures that access control policies and security measures are uniformly applied across the Azure portal. Disabling this setting could result in inconsistent access control methods or the use of outdated authentication systems.

Default Value: 

By default, this setting is disabled. It needs to be explicitly enabled to ensure that Microsoft Entra is the default authorization method for the Azure portal.

Pre-requisites:

  • Azure account: Ensure you have the necessary permissions to configure settings in the Azure portal.

  • Microsoft Entra (Azure AD): Ensure Microsoft Entra is set up and properly configured for your organization.

  • Permissions: You need appropriate permissions, such as Global Administrator or Privileged Role Administrator, to modify this setting.

Remediation:

Audit:

To check if 'Default to Microsoft Entra authorization' is enabled for your Azure portal:

  1. Sign in to the Azure portal using an account with appropriate permissions.

  2. Navigate to Microsoft Entra (Azure AD):

    • In the Azure portal, go to Azure Active Directory.

  3. Check the 'Default to Microsoft Entra authorization' setting:

    • Under Security, click on Authentication methods.

    • Verify that the 'Default to Microsoft Entra authorization' setting is Enabled.

Implementation:

To automatically enforce 'Default to Microsoft Entra authorization' for all users in your organization, you can use Azure Policy.

  1. Create a custom Azure Policy to ensure the setting is enabled:

    • Go to the Azure portal.

    • Navigate to Policy and click on Definitions.

    • Create a new Custom Policy with the following content:

{
  "properties": {
    "displayName": "Ensure Default to Microsoft Entra Authorization is Enabled",
    "policyType": "Custom",
    "mode": "All",
    "description": "This policy ensures that 'Default to Microsoft Entra authorization in the Azure portal' is enabled to enforce consistent identity management.",
    "parameters": {},
    "metadata": {
      "version": "1.0.0",
      "category": "Identity"
    },
    "policyRule": {
      "if": {
        "field": "Microsoft.Entra/authorization.defaultAuthMethod",
        "notEquals": "Entra"
      },
      "then": {
        "effect": "deny"
      }
    }
  }
}


  1. Assign the policy:

    • After creating the custom policy, assign it to the relevant subscriptions or resource groups to ensure that 'Default to Microsoft Entra authorization' is enabled across your environment.

Backout Plan:

To revert the setting:

  1. Sign in to the Azure portal with appropriate permissions.

  2. Navigate to Microsoft Entra (Azure AD):

    • Go to Azure Active Directory in the Azure portal.

  3. Disable the 'Default to Microsoft Entra authorization' setting:

    • Under Security, click on Authentication methods.

    • Change the 'Default to Microsoft Entra authorization' setting to Disabled.

    • Save the changes.

If the setting was enforced via Azure Policy, modify or remove the policy to allow the setting to be disabled.

References: