Azure Compliance ControlsMicrosoft Entra ID
Microsoft Entra ID tenants should have multifactor authentication enabled for all users
Ensure that 'multifactor authentication' is 'enabled' for all users. The powerpipe check ad_all_user_mfa_enabled states that a Conditional Access policy can be enabled to ensure that users are required to use Multifactor Authentication (MFA) to login.
What this control checks
The powerpipe check ad_all_user_mfa_enabled in the doc is titled "Ensure that a multifactor authentication policy exists for all users" and says a Conditional Access policy can be enabled to require MFA to login.
Framework mappings
The clauses this control is mapped to in each framework.
- 5.1.2 Ensure that 'multifactor authentication' is 'enabled' for all users
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
ad_user_mfa_enabled - Powerpipe Control:
azure_compliance.control.ad_user_mfa_enabled
Last reviewed: 2026-10-09