Description

Ensure every local user who can sign in to the OCI Console with a password has multi-factor authentication (MFA) enabled. The recommended way is to activate the Security Policy for OCI Console sign-on policy in each identity domain, which requires MFA for all local users signing in to the Console.

Rationale

Passwords alone can be stolen through phishing, reuse, or data breaches. Console users can change infrastructure, IAM, and security settings, so a stolen password could lead to a serious breach. MFA adds a second factor that an attacker with only the password cannot complete, which blocks most account takeover attempts.

Impact

  • All local Console users must use MFA

  • Blocks sign-in with a stolen password alone

  • Users must enroll an MFA method on their next sign-in

Default Value

Oracle has seeded the Security Policy for OCI Console sign-on policy in all tenancies and activates it by default, but it is not activated automatically if the default sign-on policy was modified or an external identity provider is configured. Federated users are not affected by it.

Pre-Requisites

  • Identity domain administrator role

  • Users informed that they will need to enroll an MFA method

  • A bypass code stored securely and a client application with the identity domain administrator role registered, to avoid lockout

  • Optionally, one administrator temporarily excluded during rollout

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).

  3. Select the Domain policies tab and find the list of sign-on policies (on some consoles, select Security > Sign-on policies).

  4. Verify that Security Policy for OCI Console is Active and that its rule requires MFA.

  5. Alternatively, select the User management tab and check the MFA status of each user with a Console password.

  6. If the policy is not active or users lack MFA, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).

  3. Select the Domain policies tab and, in the list of sign-on policies, select Security Policy for OCI Console.

  4. If it is not active, select Activate.

  5. Confirm that its two rules, MFA for administrators and MFA for all users, are active and unchanged.

  6. Tell users to enroll an MFA method, such as Oracle Mobile Authenticator, on their next sign-in.

  7. Repeat for each identity domain used for Console access.

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).

  3. Select the Domain policies tab, select Security Policy for OCI Console in the list of sign-on policies, and select Deactivate.

Reference