Azure Compliance ControlsMicrosoft Entra ID
Privileged Microsoft Entra ID users should have multifactor authentication enabled
Microsoft Entra privileged accounts are expected to use multifactor authentication. This evaluates users assigned to elevated directory roles and confirms they have multiple authentication methods registered for sign-in.
What this control checks
Privileged Microsoft Entra ID users must have multifactor authentication enabled
Framework mappings
The clauses this control is mapped to in each framework.
- 8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- 8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- 8.4.3 MFA is implemented for all remote access originating from outside the entity's network that could access or impact the CDE
- A.5.17 Authentication information
- A.8.5 Secure authentication
- 2 Risk management policy
- 3 Incident handling
- 11 Access control
- 6.1.2 Ensure that 'multifactor authentication' is 'enabled' for all users
- 5.1.2 Ensure that 'multifactor authentication' is 'enabled' for all users
- 5.2.4 Ensure that a multifactor authentication policy exists for all users
RBI Cyber Security Framework for UCBs
- Annex I (7.2)
- IAM-06.09B The cloud service provider requires two- or more factor authentication for accessing the administration interfaces used by the cloud service provider.
- IAM-08.02B Authentication credentials are managed with a security level that matches or exceeds the classification of the system component they protect.
- PSS-05.01B The cloud service provider provides authentication mechanisms that can force strong authentication (e.g. two or more factors) for users, IT components or applications within the cloud users' area of responsibility. These authentication mechanisms are set up at all access points that...
- PSS-05.02B For privileged users, IT components or applications, these authentication mechanisms are enforced.
- 1.1.2 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Privileged Users
- 1.1.2 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Privileged Users
- 2.1.2 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Privileged Users
- 164.308(a)(3)(ii)(A): Administrative Safeguards
- 164.308(a)(5)(ii)(D): Administrative Safeguards
- 164.312(a)(1) Access control
- 164.312(d) Person or entity authentication
Related controls
- Non-privileged Microsoft Entra ID users should have multifactor authentication enabled
- Microsoft Entra ID tenants should have multifactor authentication enabled for all users
- Guest users should have access reviews configured monthly
- Azure subscriptions should have more than one owner
- Virtual machines should use just-in-time network access control for management ports
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_entra_privileged_user_has_mfa - Prowler Check:
entra_privileged_user_has_mfa
Last reviewed: 2026-10-11