rules/findings/entra/authentication/eid-passwordless-authentication-not-set.json
|
{
"provider": "EntraID", "serviceType": "Identity Protection", "serviceName": "Microsoft Entra ID", "displayName": "Ensure passwordless authentication methods are considered", "description": "Passwordless authentication methods improve security and user experience by replacing passwords with something you have (e.g., a hardware key), something you are (biometrics), or something you know, offering a convenient and secure way to access resources.\u003Cbr/\u003E\u003Cbr/\u003EMicrosoft Entra ID and Azure Government integrate the following passwordless authentication options:\n\u2022 Windows Hello for Business\n\u2022 Platform Credential for macOS\n\u2022 Platform single sign-on (PSSO) for macOS with smart card authentication\n\u2022 Microsoft Authenticator\n\u2022 Passkeys (FIDO2)\n\u2022 Certificate-based authentication", "rationale": "Using passwordless authentication makes sign-in easier and more secure by removing passwords, helping to protect organizations from attacks and improving the user experience.", "impact": "Implementing passwordless authentication requires administrative effort and may incur costs for some methods. It has the potential to save time and money by improving user convenience and productivity and by reducing the need for password support.", "remediation": { "text": "\n\t\t\t1. Review the passwordless authentication method options: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-passwordless\n\t\t\t2. Choose a passwordless authentication method: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-passwordless#choose-a-passwordless-method\n\t\t\t3. Implement the chosen passwordless authentication method\n\t\t\t\t* Microsoft Authenticator: https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-enable-authenticator-passkey\n\t\t\t\t* Passkeys (FIDO2): https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-enable-passkey-fido2\n\t\t", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/entra/identity/authentication/conceptauthentication-methods", "https://learn.microsoft.com/en-us/entra/identity/authentication/conceptauthentication-passwordless" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "5.0.0", "reference": "5.28", "profile": [ "Level 2" ] } ], "level": "", "tags": [], "rule": { "path": "", "subPath": null, "selectCondition": {}, "query": [ { "filter": [ { "conditions": [] } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": {}, "expandObject": null }, "table": "default", "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": {}, "expandObject": null }, "status": { "keyName": [], "message": "", "defaultMessage": null }, "properties": { "resourceName": null, "resourceId": null, "resourceType": null }, "onlyStatus": false } }, "idSuffix": "entra_passwordless_authentication_not_set", "notes": [], "categories": [], "immutableProperties": [], "id": "entraid_authentication_001" } |