rules/findings/entra/conditional_access/eid-ensure-mfa-for-all-users-missing-cap.json
|
{
"provider": "EntraID", "serviceType": "Conditional Access", "serviceName": "Microsoft Entra ID", "displayName": "Ensure multifactor authentication is enabled for all users", "description": "Enable multifactor authentication for all users in the Microsoft 365 tenant. Users will be prompted to authenticate with a second factor upon logging in to Microsoft 365 services. The second factor is most commonly a text message to a registered mobile phone number where they type in an authorization code, or with a mobile application like Microsoft Authenticator.", "rationale": "Multifactor authentication requires an individual to present a minimum of two separate forms of authentication before access is granted. Multifactor authentication provides additional assurance that the individual attempting to gain access is who they claim to be. With multifactor authentication, an attacker would need to compromise at least two different authentication mechanisms, increasing the difficulty of compromise and thus reducing the risk.", "impact": "Implementation of multifactor authentication for all users will necessitate a change to user routine. All users will be required to enroll in multifactor authentication using phone, SMS, or an authentication application. After enrollment, use of multifactor authentication will be required for future authentication to the environment.\r\nExternal identities that attempt to access documents that utilize Purview Information Protection (Sensitivity Labels) will find their access disrupted. In order to mitigate this create an exclusion for `Microsoft Rights Management Services` ID: 000000120000-0000-c000-000000000000. \r\n*Note*: Organizations that struggle to enforce MFA globally due to budget constraints preventing the provision of company-owned mobile devices to every user, or due to regulations, unions, or policies that prevent forcing end users to use their personal devices, have another option. FIDO2 security keys can be used as an alternative. They are more secure, phishing-resistant, and affordable for organizations to issue to every end user.", "remediation": { "text": "###### From Azure Console\r\n\t\t\t\t\t1. From Azure Home open the Portal Menu in top left, and select Microsoft Entra ID\r\n\t\t\t\t\t2. Scroll down in the menu on the left, and select `Security`\r\n\t\t\t\t\t3. Select on the left side `Conditional Access`\r\n\t\t\t\t\t4. Click the `+ New policy`", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-all-users-mfa-strength", "https://learn.microsoft.com/en-us/azure/active-directory/roles/security-emergency-access", "https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/troubleshoot-conditional-access-what-if", "https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/plan-conditional-access", "https://learn.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-identity-management#im-7-restrict-resource-access-based-on--conditions" ], "compliance": [ { "name": "CIS Microsoft 365 Foundations Benchmark", "version": "6.1.0", "reference": "5.2.2.2", "profile": [ "E3 Level 1", "E5 Level 1" ] } ], "level": "medium", "tags": [ ], "rule": { "path": "aad_conditional_access_policy", "subPath": null, "selectCondition": { }, "query": [ { "filter": [ { "conditions": [ [ "state", "eq", "enabled" ], [ "conditions.users.includeUsers", "eq", "All" ], [ "conditions.applications.includeApplications", "eq", "All" ] ], "operator": "and" } ] }, { "connectOperator": "and", "filter": [ { "conditions": [ [ "grantControls.operator", "eq", "OR" ], [ "grantControls.builtInControls", "imatch", "mfa" ] ], "operator": "and" } ] }, { "connectOperator": "or", "filter": [ { "conditions": [ [ "grantControls.operator", "eq", "OR" ], [ "grantControls.authenticationStrength.id", "imatch", "00000000-0000-0000-0000-000000000004" ] ], "operator": "and" } ] } ], "shouldExist": "true", "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "displayName": "Name", "state": "Status", "conditions.applications.includeApplications": "Applications", "conditions.users.includeUsers": "Users", "conditions.userRiskLevels": "User Risk Levels", "grantControls.operator": "Operator", "grantControls.builtInControls": "BuiltIn Controls" }, "expandObject": null }, "table": "default", "decorate": [ ], "emphasis": [ ], "actions": { "objectData": { "properties": [ "*" ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { "displayName": "Name", "state": "Status", "conditions.applications.includeApplications": "Applications", "conditions.users.includeUsers": "Users", "conditions.userRiskLevels": "User Risk Levels", "grantControls.operator": "Operator", "grantControls.builtInControls": "BuiltIn Controls" }, "expandObject": null }, "status": { "keyName": [ "displayName" ], "message": "The {displayName} policy is not configured to require MFA for all users", "defaultMessage": null }, "properties": { "resourceName": "displayName", "resourceId": "id", "resourceType": "EntraConditionalAccess" }, "onlyStatus": true } }, "idSuffix": "aad_cap_force_mfa_all_users", "notes": [ ], "categories": [ ], "immutable_properties": [ "id" ], "id": "entraid_1110" } |