Control: 1.2.3 Ensure that A Multi-factor Authentication Policy Exists for Administrative Groups
Description
For designated users, they will be prompted to use their multi-factor authentication (MFA) process on login.
Enabling multi-factor authentication is a recommended setting to limit the use of Administrative accounts to authenticated personnel.
Remediation
From Azure Portal
- From Azure Home open the Portal Menu in top left, and select Azure Active Directory.
- Scroll down in the menu on the left, and select
Security. - Select on the left side
Conditional Access. - Click the
+ New policy
Default Value
By default, MFA is not enabled for any administrative accounts.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v150_1_2_3Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v150_1_2_3 --shareSQL
This control uses a named query:
ad_manual_control