Policy: Azure > CIS v3.0 > 02 - Identity > 02.02 - Conditional Access > 02.02.08 - Ensure Multi-factor Authentication is Required to access Microsoft Admin Portals

Configures auditing against a CIS Benchmark item.

Level: 2

This recommendation ensures that users accessing Microsoft Admin Portals (i.e. Microsoft 365 Admin, Microsoft 365 Defender, Exchange Admin Center, Azure Portal, etc.) are required to use multi-factor authentication (MFA) credentials when logging into an Admin Portal.

Administrative Portals for Microsoft Azure should be secured with a higher level of scrutiny to authenticating mechanisms. Enabling multi-factor authentication is recommended to reduce the potential for abuse of Administrative actions, and to prevent intruders or compromised admin credentials from changing administrative settings.

Targets

This policy targets the following resource types:

Azure > Active Directory > Directory

Primary Policy

This policy is used with the following primary policy:

Azure > CIS v3.0 > 02 - Identity > 02.02 - Conditional Access

Policy Specification

Schema Type	`string`
Default	`Per Azure > CIS v3.0 > 02 - Identity`
Valid Values [YAML]	`Per Azure > CIS v3.0 > 02 - Identity` `Skip` `Check: Benchmark`

In Your Workspace

Policy Settings by Type report

Developers

Category URI

tmod:@turbot/cis#/control/categories/v070401

Policy Type URI

tmod:@turbot/azure-cisv3-0#/policy/types/r020208

GraphQL

query policyType(id: "tmod:@turbot/azure-cisv3-0#/policy/types/r020208") { … }

query policySettings(filter: "policyTypeId:'tmod:@turbot/azure-cisv3-0#/policy/types/r020208'") { … }

query policyValues(filter: "policyTypeId:'tmod:@turbot/azure-cisv3-0#/policy/types/r020208'") { … }

CLI

Get Policy Type

turbot graphql policy-type --id "tmod:@turbot/azure-cisv3-0#/policy/types/r020208"

Get Policy Settings

turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/azure-cisv3-0#/policy/types/r020208"