Users in administrative roles require multifactor authentication via a Conditional Access policy for all applications
entra_admin_users_mfa_enabled
Microsoft Entra Conditional Access policies that enforce multifactor authentication for users in administrative roles across all resources.
The assessment identifies at least one active policy that targets admin roles (or all users), includes all applications, and grants access only when Require multifactor authentication is satisfied.
Risk
Without enforced MFA on privileged accounts, stolen or phished passwords can grant admin access, enabling tenant takeover. Attackers may exfiltrate data, change configurations, consent malicious apps, and disable protections, impacting confidentiality, integrity, and availability.
prowler m365 --checks entra_admin_users_mfa_enabled
Recommendation
Require MFA for all administrative roles with Conditional Access scoped to All cloud apps to avoid gaps. Prefer phishing-resistant methods (FIDO2, passkeys, Authenticator). Apply least privilege, limit exclusions, protect break-glass accounts, monitor sign-ins, and verify policies actively enforce, not just report.
Remediation
az rest --method post --url https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies --body '{"displayName":"Require MFA for all users","state":"enabled","conditions":{"users":{"includeUsers":["All"]},"applications":{"includeApplications":["All"]}},"grantControls":{"operator":"OR","builtInControls":["mfa"]}}'
- Sign in to Microsoft Entra admin center > Entra ID > Protection > Conditional Access > Policies > New policy
- Users: Include > All users
- Target resources: Include > All cloud apps (All resources)
- Grant: Grant access > Require multifactor authentication > Select
- Enable policy: On > Create
Source Code
Resource Type
NotDefined
References
- https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-getstarted
- https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-alt-all-users-compliant-hybrid-or-mfa
- https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-policy-admin-mfa
- https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-azure-mfa
- https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-alt-admin-device-compliand-hybrid
- https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-userstates