Policy: Azure > CIS v4.0 > 04 - Compute Services > 04.01 - Virtual Machines > 04.01.01 - Ensure only MFA enabled identities can access privileged Virtual Machine > Attestation

By setting this policy, you attest that you have manually verified that it complies with the relevant section of the CIS Benchmark.

Ensure only MFA enabled identities can access privileged Virtual Machine.

Azure Portal - Verify Conditional Access: 1. Navigate to Microsoft Entra ID > Security > Conditional Access. 2. Review policies that target Azure Management or Virtual Machines. 3. Verify that MFA is required for privileged roles. 4. Ensure the policy applies to all users with VM administrative access.

Azure Portal - Verify RBAC Assignments: 1. Navigate to the Virtual Machine or Resource Group. 2. Select Access control (IAM) > Role assignments. 3. Review users with Owner, Contributor, or Virtual Machine Administrator roles. 4. Verify these users are covered by MFA requirements in Conditional Access.

Azure Portal - Verify User MFA Status: 1. Navigate to Microsoft Entra ID > Users. 2. Select Per-user MFA or review Authentication methods. 3. Verify all privileged users have MFA configured.

Once verified, enter the date that this attestation expires. Note that the date can not be further in the future than is specified in report level Maximum Attestation Duration policy. Set to a blank value to clear the attestation.