Microsoft Entra ID tenants should have a multifactor authentication policy configured for all users
Ensure that a multifactor authentication policy exists for all users. A Conditional Access policy can be enabled to ensure that users are required to use Multifactor Authentication (MFA) to login.
What this control checks
Microsoft Entra ID tenants should have a multifactor authentication policy for all users
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.ad_all_user_mfa_enabled.
Framework-specific interpretation
CIS Azure Benchmark v5.0.0: Mapped to 5.2.4 (Ensure that a multifactor authentication policy exists for all users).
Framework mappings
The clauses this control is mapped to in each framework.
- 5.2.4 Ensure that a multifactor authentication policy exists for all users
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
ad_all_user_mfa_enabled - Powerpipe Control:
azure_compliance.control.ad_all_user_mfa_enabled
Last reviewed: 2026-10-09