Policy: Azure > CIS v5.0 > 5 - Identity Services > 5.01 - Security Defaults (Per-User MFA) > 5.01.02 - Ensure that 'multifactor authentication' is 'enabled' for all users

Configures auditing against a CIS Benchmark item.

Level: 1

IMPORTANT: If your organization pays for Microsoft Entra ID licensing and CAN use Conditional Access, skip this recommendation and proceed to the Conditional Access section (6.2).

Enable multi-factor authentication for all users in the Microsoft Entra ID. Multi-factor authentication is a process that requires an additional form of identification during the sign-in process, such as a code on your cellphone or a fingerprint scan, to enhance security.

NOTE: Since 2024, Azure has been rolling out mandatory multifactor authentication for Azure sign-in.

Multi-factor authentication requires an individual to present a minimum of two separate forms of authentication before access is granted. Multi-factor authentication provides additional assurance that the individual attempting to gain access is who they claim to be. With multi-factor authentication, an attacker would need to compromise at least two different authentication mechanisms, increasing the difficulty of compromise and thus reducing the risk.

By default, multifactor authentication is not enabled for all users. Starting in 2024, multifactor authentication is enabled for administrative accounts by default.