Azure Compliance ControlsMicrosoft Entra ID
Microsoft Entra ID users with VM access should have multifactor authentication enabled
Evaluates Microsoft Entra users who hold Azure roles granting VM sign-in or management access, such as `Owner`, `Contributor`, `Virtual Machine * Login`, and `Virtual Machine Contributor`, to determine whether each user is enrolled in multi-factor authentication.
What this control checks
Entra users with VM access roles must have multi-factor authentication enrollment.
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives
- A.5.17 Authentication information
- A.8.5 Secure authentication
- 2 Risk management policy
- 3 Incident handling
- 11 Access control
- 4.1.1 Ensure only MFA enabled identities can access privileged Virtual Machine
- 3.1.1 Ensure only MFA enabled identities can access privileged Virtual Machine
RBI Cyber Security Framework for UCBs
- Annex I (7.2)
- IAM-01.01B The cloud service provider documents, communicates and makes available according to SP-01: - A role, rights and authorities concept based on role-based access control and the business and security requirements of the cloud service provider; and- A policy for managing user accounts and...
- IAM-06.01B Privileged access rights for internal and external employees as well as technical users of the cloud service provider are assigned and changed in accordance with the policy for managing user accounts and access rights (cf. IAM-01) or a separate specific policy.
- IAM-06.02B Privileged access rights are personalised, limited in time according to a risk assessment and assigned as necessary for the execution of tasks ('need-to-know principle').
- IAM-06.09B The cloud service provider requires two- or more factor authentication for accessing the administration interfaces used by the cloud service provider.
- IAM-08.02B Authentication credentials are managed with a security level that matches or exceeds the classification of the system component they protect.
9 more clauses
- IAM-08.05B The cloud service provider documents, communicates and makes available to all users under its responsibility rules and recommendations for the management of credentials, including at least: - Non-reuse of credentials;- Trade-offs between entropy and ability to memorise;-...
- IAM-09.01AC Access to the non-production environment requires two-factor or multi-factor authentication.
- IAM-09.02B Access to the production environment requires two-factor or multi-factor authentication.
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- OPS-16.01B Access to system components for logging and monitoring in the cloud service provider's area of responsibility is restricted to authorised users and requires authentication with two or more factors.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- PSS-05.01B The cloud service provider provides authentication mechanisms that can force strong authentication (e.g. two or more factors) for users, IT components or applications within the cloud users' area of responsibility. These authentication mechanisms are set up at all access points that...
- SP-01.04B The policies and instructions are approved by the top management of the cloud service provider or an authorised body.
- 7.8 Ensure only MFA enabled identities can access privileged Virtual Machine
- 8.10 Ensure only MFA enabled identities can access privileged Virtual Machine
- 164.308(a)(3)(ii)(A): Administrative Safeguards
- 164.312(d) Person or entity authentication
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_entra_user_with_vm_access_has_mfa - Prowler Check:
entra_user_with_vm_access_has_mfa
Last reviewed: 2026-10-11