Ensure MFA is enabled for all privileged users
Description
Multi-factor authentication must be enabled for all users with administrative roles in Azure AD.
⚠️ Risk Impact
Privileged accounts without MFA are high-value targets. A compromised Global Admin can control the entire Azure tenant.
🔍 How EchelonGraph Detects This
EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected Azure accounts. Violations are flagged as critical-severity findings with remediation guidance.
🔧 Remediation
Enable MFA via Azure AD > Security > MFA > Conditional Access policies.
💀 Real-World Attack Scenario
An attacker compromised a Global Admin's Azure AD credentials through a password spray attack. Without MFA, they gained full tenant control, created a backdoor admin account, and exfiltrated 1.4M customer records from Azure SQL databases across 3 subscriptions before the quarterly access review.
💰 Cost of Non-Compliance
Microsoft reports 99.9% of compromised accounts don't have MFA. SolarWinds breach (2020) exploited admin accounts without MFA. Average Azure tenant compromise cost: $4.2M. Azure AD Premium P2 with Conditional Access: $9/user/month.
📋 Audit Questions
- 1.Show Conditional Access policies requiring MFA for admin roles.
- 2.Which privileged users do not have MFA enforced?
- 3.Is MFA required for Azure Portal, CLI, and PowerShell access?
- 4.What is your break-glass account process?
🎯 MITRE ATT&CK Mapping
⚡ Common Pitfalls
- ⛔Using Security Defaults instead of Conditional Access (no granular control)
- ⛔Not requiring MFA for non-interactive service principals with admin roles
- ⛔Break-glass accounts without monitored MFA bypass procedures
📈 Business Value
Azure AD MFA with Conditional Access is the #1 defense against identity-based attacks. It blocks 99.9% of account compromises and is the first checkpoint in every Azure security audit.
⏱️ Effort Estimate
2-4 hours to configure Conditional Access policies
EchelonGraph monitors MFA enforcement across all Azure AD users
🔗 Cross-Framework References
Automate CIS Azure 1.1 compliance
EchelonGraph continuously monitors this control across all your cloud accounts.
Start Free →