Azure Compliance ControlsMicrosoft Entra ID
Non-privileged Microsoft Entra ID users should have multifactor authentication enabled
Microsoft Entra non-privileged users are assessed for multifactor authentication. The check verifies they have two or more registered authentication methods (MFA enrollment).
What this control checks
Non-privileged Entra users pass with two or more registered authentication methods (MFA enrollment).
Framework mappings
The clauses this control is mapped to in each framework.
- 8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- 8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- 8.4.3 MFA is implemented for all remote access originating from outside the entity's network that could access or impact the CDE
- A.5.17 Authentication information
- A.8.5 Secure authentication
- 11 Access control
- 6.1.2 Ensure that 'multifactor authentication' is 'enabled' for all users
- 5.1.2 Ensure that 'multifactor authentication' is 'enabled' for all users
- 5.2.4 Ensure that a multifactor authentication policy exists for all users
RBI Cyber Security Framework for UCBs
- Annex I (7.2)
- IAM-09.01AC Access to the non-production environment requires two-factor or multi-factor authentication.
- PSS-05.01B The cloud service provider provides authentication mechanisms that can force strong authentication (e.g. two or more factors) for users, IT components or applications within the cloud users' area of responsibility. These authentication mechanisms are set up at all access points that...
- 1.1.3 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Non-Privileged Users
- 1.1.3 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Non-Privileged Users
- 2.1.3 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Non-Privileged Users
- 164.308(a)(3)(ii)(A): Administrative Safeguards
- 164.308(a)(5)(ii)(D): Administrative Safeguards
- 164.312(d) Person or entity authentication
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_entra_non_privileged_user_has_mfa - Prowler Check:
entra_non_privileged_user_has_mfa
Last reviewed: 2026-10-11