Control: 1.1.1 Ensure multifactor authentication is enabled for all users in administrative roles

Description

Enable multifactor authentication for all users who are members of administrative roles in the Microsoft 365 tenant. These include roles such as:

• Global Administrator
• Billing Administrator
• Exchange Administrator
• SharePoint Administrator
• Password Administrator
• Skype for Business Administrator
• Service Support Administrator
• User Administrator
• Dynamics 365 Service Administrator
• Power BI Administrator

Multifactor authentication requires an individual to present a minimum of two separate forms of authentication before access is granted. Multifactor authentication provides additional assurance that the individual attempting to gain access is who they claim to be. With multifactor authentication, an attacker would need to compromise at least two different authentication mechanisms, increasing the difficulty of compromise and thus reducing the risk.

Remediation

To enable multifactor authentication for administrators, use the Microsoft 365 Admin Center:

1. Log in to https://admin.microsoft.com as a Global Administrator.
2. Go to Admin centers and click on Azure Active Directory.
3. Select Enterprise applications then, under Security, select Conditional Access.
4. Click New policy.
5. Go to Assignments > Users and groups > Include > Select users and groups > check Directory roles.
6. At a minimum, select the following roles: Billing admin, Conditional Access admin, Exchange admin, Global admin, Helpdesk admin, Security admin, SharePoint admin, and User admin.
7. Go to Cloud apps or actions > Cloud apps > Include > select All cloud apps (and don't exclude any apps).
8. Under Access controls > Grant > select Grant access > check Require multi-factor authentication (and nothing else).
9. Leave all other conditions blank.
10. Make sure the policy is enabled.
11. Create.