rules/findings/entra/conditional_access/eid-ensure-mfa-for-high-privileged-users-missing-cap.json
|
{
"provider": "EntraID", "serviceType": "Conditional Access", "serviceName": "Microsoft Entra ID", "displayName": "Ensure multifactor authentication is enabled for all users in administrative roles", "description": "Multifactor authentication is a process that requires an additional form of identification during the sign-in process, such as a code from a mobile device or a fingerprint scan, to enhance security.\r\nEnsure users in administrator roles have MFA capabilities enabled.", "rationale": "Multifactor authentication requires an individual to present a minimum of two separate forms of authentication before access is granted. Multifactor authentication provides additional assurance that the individual attempting to gain access is who they claim to be. With multifactor authentication, an attacker would need to compromise at least two different authentication mechanisms, increasing the difficulty of compromise and thus reducing the risk.", "impact": "Implementation of multifactor authentication for all users in administrative roles will necessitate a change to user routine. All users in administrative roles will be required to enroll in multifactor authentication using phone, SMS, or an authentication application. After enrollment, use of multifactor authentication will be required for future access to the environment.", "remediation": { "text": "###### From Azure Console\r\n\t\t\t\t\t1. From Azure Home open the Portal Menu in top left, and select Microsoft Entra ID\r\n\t\t\t\t\t2. Scroll down in the menu on the left, and select `Security`\r\n\t\t\t\t\t3. Select on the left side `Conditional Access`\r\n\t\t\t\t\t4. Click the `+ New policy`", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-old-require-mfa-admin", "https://learn.microsoft.com/en-us/azure/active-directory/roles/security-emergency-access", "https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/troubleshoot-conditional-access-what-if", "https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/plan-conditional-access", "https://learn.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-identity-management#im-7-restrict-resource-access-based-on--conditions" ], "compliance": [ { "name": "CIS Microsoft 365 Foundations Benchmark", "version": "5.0.0", "reference": "5.2.2.1", "profile": [ "E3 Level 1", "E5 Level 1" ] } ], "level": "medium", "tags": [ ], "rule": { "path": "aad_conditional_access_policy", "subPath": null, "selectCondition": { }, "query": [ { "filter": [ { "conditions": [ [ "state", "eq", "enabled" ], [ "conditions.applications.includeApplications", "eq", "All" ] ], "operator": "and" } ] }, { "connectOperator": "and", "filter": [ { "conditions": [ [ "MicrosoftAdminPortals", "notin", "conditions.applications.excludeApplications" ], [ "Office365", "notin", "conditions.applications.excludeApplications" ] ], "operator": "or" } ] }, { "connectOperator": "and", "filter": [ { "conditions": [ [ "grantControls.operator", "eq", "OR" ], [ "grantControls.builtInControls", "match", "mfa" ] ], "operator": "and" } ] }, { "connectOperator": "or", "filter": [ { "conditions": [ [ "grantControls.operator", "eq", "OR" ], [ "grantControls.authenticationStrength.id", "imatch", "00000000-0000-0000-0000-000000000004" ] ], "operator": "and" } ] }, { "connectOperator": "and", "filter": [ { "include": "_ARG_0_" } ] } ], "shouldExist": "true", "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "displayName": "Name", "state": "Status", "conditions.applications.includeApplications": "Applications", "conditions.users.includeRoles": "Users", "grantControls.operator": "Operator", "grantControls.builtInControls": "BuiltIn Controls" }, "expandObject": null }, "table": "default", "decorate": [ ], "emphasis": [ ], "actions": { "objectData": { "properties": [ "*" ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { "displayName": "Name", "state": "Status", "conditions.applications.includeApplications": "Applications", "conditions.users.includeRoles": "Users", "grantControls.operator": "Operator", "grantControls.builtInControls": "BuiltIn Controls" }, "expandObject": null }, "status": { "keyName": [ ], "message": "Missing MFA conditional access for privileged roles", "defaultMessage": null }, "properties": { "resourceName": "displayName", "resourceId": "id", "resourceType": "EntraConditionalAccess" }, "onlyStatus": true } }, "idSuffix": "aad_cap_force_mfa_high_users", "notes": [ ], "categories": [ ], "immutable_properties": [ "id" ], "id": "entraid_1108" } |