Control: 5.5 Ensure that 'Number of methods required to reset' is set to '2'
Description
Ensures that two alternate forms of identification are provided before allowing a password reset.
A Self-service Password Reset (SSPR) through Azure Multi-factor Authentication (MFA) ensures the user's identity is confirmed using two separate methods of identification. With multiple methods set, an attacker would have to compromise both methods before they could maliciously reset a user's password.
Remediation
Remediate from Azure Portal
- From Azure Home select the Portal Menu.
- Select
Microsoft Entra ID. - Under
Manage, selectUsers. - Under
Manage, selectPassword reset. - Select
Authentication methods. - Set the
Number of methods required to resetto 2. - Click
Save.
Default Value
By default, the Number of methods required to reset is 1.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v500_5_5Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v500_5_5 --shareSQL
This control uses a named query:
select id as resource, 'info' as status, 'Manual verification required.' as reason, display_name as subscriptionfrom azure_subscription;