rules/findings/entra/conditional_access/eid-ensure-mfa-for-azure-management-missing-cap.json
|
{
"provider": "EntraID", "serviceType": "Conditional Access", "serviceName": "Microsoft Entra ID", "displayName": "Ensure Multi-factor Authentication is Required for Azure Management", "description": "For designated users, they will be prompted to use their multi-factor authentication (MFA) process on logins.", "rationale": "Enabling multi-factor authentication is a recommended setting to limit the potential of accounts being compromised and limiting access to authenticated personnel.", "impact": "There is an increased cost, as Conditional Access policies require Microsoft Entra ID Premium. Similarly, this may require additional overhead to maintain if users lose access to their MFA.", "remediation": { "text": "###### From Azure Console\r\n\t\t\t\t\t1. From Azure Home open the Portal Menu in top left, and select Microsoft Entra ID\r\n\t\t\t\t\t2. Scroll down in the menu on the left, and select \u0060Security\u0060\r\n\t\t\t\t\t3. Select on the left side \u0060Conditional Access\u0060\r\n\t\t\t\t\t4. Click the \u0060\u002B New policy\u0060", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa", "https://learn.microsoft.com/en-us/azure/active-directory/roles/security-emergency-access", "https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/troubleshoot-conditional-access-what-if", "https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/plan-conditional-access", "https://learn.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-identity-management#im-7-restrict-resource-access-based-on--conditions" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "3.0.0", "reference": "2.2.7" } ], "level": "medium", "tags": [], "rule": { "path": "aad_conditional_access_policy", "subPath": null, "selectCondition": {}, "query": [ { "filter": [ { "conditions": [ [ "state", "eq", "enabled" ], [ "conditions.applications.includeApplications", "imatch", "797f4846-ba00-4fd7-ba43-dac1f8f63013" ], [ "conditions.users.includeUsers", "eq", "All" ], [ "conditions.users.includeUsers", "eq", "All" ] ], "operator": "and" } ] }, { "connectOperator": "and", "filter": [ { "conditions": [ [ "grantControls.operator", "eq", "OR" ], [ "grantControls.builtInControls", "imatch", "mfa" ] ], "operator": "and" } ] } ], "shouldExist": "true", "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "displayName": "Name", "state": "Status", "conditions.applications.includeApplications": "Applications", "conditions.users.includeRoles": "Users", "grantControls.operator": "Operator", "grantControls.builtInControls": "BuiltIn Controls" }, "expandObject": null }, "table": "default", "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [ "*" ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": {}, "expandObject": null }, "status": { "keyName": [ "displayName" ], "message": "The {displayName} policy is not configured to require MFA for Azure Management", "defaultMessage": null }, "properties": { "resourceName": "displayName", "resourceId": "id", "resourceType": "EntraConditionalAccess" }, "onlyStatus": true } }, "idSuffix": "aad_cap_force_mfa_azure_management", "notes": [], "categories": [], "immutableProperties": [ "id" ], "id": "entraid_1107" } |