rules/findings/entra/conditional_access/eid-ensure-mfa-for-azure-management-missing-cap.json
|
{
"provider": "EntraID", "serviceType": "Conditional Access", "serviceName": "Microsoft Entra ID", "displayName": "Ensure Multi-factor Authentication is Required for Azure Management", "description": "For designated users, they will be prompted to use their multi-factor authentication (MFA) process on logins.", "rationale": "Enabling multi-factor authentication is a recommended setting to limit the potential of accounts being compromised and limiting access to authenticated personnel.", "impact": "There is an increased cost, as Conditional Access policies require Microsoft Entra ID Premium. Similarly, this may require additional overhead to maintain if users lose access to their MFA.", "remediation": { "text": "###### From Azure Console\r\n\t\t\t\t\t1. From Azure Home open the Portal Menu in top left, and select Microsoft Entra ID\r\n\t\t\t\t\t2. Scroll down in the menu on the left, and select `Security`\r\n\t\t\t\t\t3. Select on the left side `Conditional Access`\r\n\t\t\t\t\t4. Click the `+ New policy`", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa", "https://learn.microsoft.com/en-us/azure/active-directory/roles/security-emergency-access", "https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/troubleshoot-conditional-access-what-if", "https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/plan-conditional-access", "https://learn.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-identity-management#im-7-restrict-resource-access-based-on--conditions" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "3.0.0", "reference": "2.2.7" } ], "level": "medium", "tags": [ ], "rule": { "path": "aad_conditional_access_policy", "subPath": null, "selectCondition": { }, "query": [ { "filter": [ { "conditions": [ [ "state", "eq", "enabled" ], [ "conditions.applications.includeApplications", "imatch", "797f4846-ba00-4fd7-ba43-dac1f8f63013" ], [ "conditions.users.includeUsers", "eq", "All" ], [ "conditions.users.includeUsers", "eq", "All" ] ], "operator": "and" } ] }, { "connectOperator": "and", "filter": [ { "conditions": [ [ "grantControls.operator", "eq", "OR" ], [ "grantControls.builtInControls", "imatch", "mfa" ] ], "operator": "and" } ] } ], "shouldExist": "true", "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "displayName": "Name", "state": "Status", "conditions.applications.includeApplications": "Applications", "conditions.users.includeRoles": "Users", "grantControls.operator": "Operator", "grantControls.builtInControls": "BuiltIn Controls" }, "expandObject": null }, "table": "default", "decorate": [ ], "emphasis": [ ], "actions": { "objectData": { "properties": [ "*" ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { }, "expandObject": null }, "status": { "keyName": [ "displayName" ], "message": "The {displayName} policy is not configured to require MFA for Azure Management", "defaultMessage": null }, "properties": { "resourceName": "displayName", "resourceId": "id", "resourceType": "EntraConditionalAccess" }, "onlyStatus": true } }, "idSuffix": "aad_cap_force_mfa_azure_management", "notes": [ ], "categories": [ ], "immutable_properties": [ "id" ], "id": "entraid_1107" } |