Azure Compliance ControlsMicrosoft Entra ID
Azure Service Management API should require multifactor authentication
Users accessing the Windows Azure Service Management API must use multifactor authentication. The Prowler check verifies at least one enabled Conditional Access policy requires multifactor authentication for it, covering Azure Portal, CLI, PowerShell, and IaC tools.
What this control checks
An enabled Conditional Access policy requires MFA for the Windows Azure Service Management API.
Framework mappings
The clauses this control is mapped to in each framework.
- A.5.17 Authentication information
- A.8.5 Secure authentication
- 11 Access control
- 6.2.6 Ensure that multifactor authentication is required for Windows Azure Service Management API
- 5.2.6 Ensure that multifactor authentication is required for Windows Azure Service Management API
RBI Cyber Security Framework for UCBs
- Annex I (7.2)
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- IAM-01.01B The cloud service provider documents, communicates and makes available according to SP-01: - A role, rights and authorities concept based on role-based access control and the business and security requirements of the cloud service provider; and- A policy for managing user accounts and...
- IAM-06.01B Privileged access rights for internal and external employees as well as technical users of the cloud service provider are assigned and changed in accordance with the policy for managing user accounts and access rights (cf. IAM-01) or a separate specific policy.
- IAM-06.02B Privileged access rights are personalised, limited in time according to a risk assessment and assigned as necessary for the execution of tasks ('need-to-know principle').
16 more clauses
- IAM-06.09B The cloud service provider requires two- or more factor authentication for accessing the administration interfaces used by the cloud service provider.
- IAM-08.02B Authentication credentials are managed with a security level that matches or exceeds the classification of the system component they protect.
- IAM-08.05B The cloud service provider documents, communicates and makes available to all users under its responsibility rules and recommendations for the management of credentials, including at least: - Non-reuse of credentials;- Trade-offs between entropy and ability to memorise;-...
- IAM-09.01AC Access to the non-production environment requires two-factor or multi-factor authentication.
- IAM-09.02B Access to the production environment requires two-factor or multi-factor authentication.
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- OIS-02.01B Top management of the cloud service provider has adopted an information security policy.
- OIS-02.02B Top management of the cloud service provider has communicated the information security policy to internal and external employees as well as cloud service customers.
- OIS-04.01AC The cloud service provider monitors and enforces measures related to segregation of duties to resolve conflicting roles.
- OPS-16.01B Access to system components for logging and monitoring in the cloud service provider's area of responsibility is restricted to authorised users and requires authentication with two or more factors.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- PSS-05.01B The cloud service provider provides authentication mechanisms that can force strong authentication (e.g. two or more factors) for users, IT components or applications within the cloud users' area of responsibility. These authentication mechanisms are set up at all access points that...
- PSS-05.02B For privileged users, IT components or applications, these authentication mechanisms are enforced.
- PSS-09.01AC Access controls are attribute-based to enable granular and contextual checks against multiple attributes of a user, IT component, or application (e.g., role, location, authentication method).
- SP-01.04B The policies and instructions are approved by the top management of the cloud service provider or an authorised body.
- 1.2.6 Ensure Multifactor Authentication is Required for Windows Azure Service Management API
- 2.2.7 Ensure Multifactor Authentication is Required for Windows Azure Service Management API
- 164.312(d) Person or entity authentication
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
ad_mfa_service_mgmt_api - Powerpipe Control:
azure_compliance.control.ad_mfa_service_mgmt_api - Prowler Check:
entra_conditional_access_policy_require_mfa_for_management_api
Last reviewed: 2026-10-09