Azure Compliance ControlsMicrosoft Entra ID
Microsoft Entra ID tenants should have a multifactor authentication policy configured for all users
Ensure that a multifactor authentication policy exists for all users. A Conditional Access policy can be enabled to ensure that users are required to use Multifactor Authentication (MFA) to login.
What this control checks
Microsoft Entra ID tenants should have a multifactor authentication policy for all users
Framework mappings
The clauses this control is mapped to in each framework.
- 5.2.4 Ensure that a multifactor authentication policy exists for all users
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
ad_all_user_mfa_enabled - Powerpipe Control:
azure_compliance.control.ad_all_user_mfa_enabled
Last reviewed: 2026-10-09