The following 4 compliance controls are associated with this Policy definition '[Deprecated]: Accounts with read permissions on Azure resources should be MFA enabled' (81b3ccb4-e6e8-4e4a-8d05-5df25cd29fd4)
Use the filters above each column to filter and limit table data. Advanced searches can be performed by using the following operators: <, <=, >, >=, =, *, !, {, }, ||,&&, [empty], [nonempty], rgx: Learn more
Use multi-factor authentication for all Microsoft Entra ID based access
Customer
Enable Microsoft Entra MFA and follow Azure Security Center Identity and Access Management recommendations.
How to enable MFA in Azure:
https://docs.microsoft.com/azure/active-directory/authentication/howto-mfa-getstarted
How to monitor identity and access within Azure Security Center:
https://docs.microsoft.com/azure/security-center/security-center-identity-access
Use strong authentication controls for all Microsoft Entra ID based access
Customer
Microsoft Entra ID supports strong authentication controls through multi-factor authentication (MFA) and strong passwordless methods.
- Multi-factor authentication: Enable Microsoft Entra MFA and follow Azure Security Center identity and access management recommendations for your MFA setup. MFA can be enforced on all users, select users, or at the per-user level based on sign-in conditions and risk factors.
- Passwordless authentication: Three passwordless authentication options are available: Windows Hello for Business, Microsoft Authenticator app, and on-premises authentication methods such as smart cards.
For administrator and privileged users, ensure the highest level of the strong authentication method is used, followed by rolling out the appropriate strong authentication policy to other users.
If legacy password-based authentication is still used for Microsoft Entra ID authentication, please be aware that cloud-only accounts (user accounts created directly in Azure) have a default baseline password policy. And hybrid accounts (user accounts that come from on-premises Active Directory) follow the on-premises password policies. When using password-based authentication, Microsoft Entra ID provides a password protection capability that prevents users from setting passwords that are easy to guess. Microsoft provides a global list of banned passwords that is updated based on telemetry, and customers can augment the list based on their needs (e.g. branding, cultural references, etc.). This password protection can be used for cloud-only and hybrid accounts.
Note: Authentication based on password credentials alone is susceptible to popular attack methods. For higher security, use strong authentication such as MFA and a strong password policy. For third-party applications and marketplace services that may have default passwords, you should change them during initial service setup.
How to enable MFA in Azure: https://docs.microsoft.com/azure/active-directory/authentication/howto-mfa-getstarted
Introduction to passwordless authentication options for Microsoft Entra ID: https://docs.microsoft.com/azure/active-directory/authentication/concept-authentication-passwordless
Microsoft Entra ID default password policy: https://docs.microsoft.com/azure/active-directory/authentication/concept-sspr-policy#password-policies-that-only-apply-to-cloud-user-accounts
Eliminate bad passwords using Microsoft Entra Password Protection: https://docs.microsoft.com/azure/active-directory/authentication/concept-password-ban-bad
Use the filters above each column to filter and limit table data. Advanced searches can be performed by using the following operators: <, <=, >, >=, =, *, !, {, }, ||,&&, [empty], [nonempty], rgx: Learn more
Minor, new suffix: deprecated (1.0.0 > 1.1.0-deprecated)
2022-08-09 17:24:03
add
81b3ccb4-e6e8-4e4a-8d05-5df25cd29fd4
JSON compare
compare mode:version left:version right:
1.0.0 → 1.1.0-deprecatedRENAMED
@@ -1,12 +1,13 @@
1
{
2
- "displayName": "Accounts with read permissions on Azure resources should be MFA enabled",
3
"policyType": "BuiltIn",
4
"mode": "All",
5
- "description": "Multi-FactorAuthentication(MFA)shouldbeenabledforallsubscriptionaccountswithreadprivileges to prevent a breach of accounts or resources.",
6
"metadata": {
7
- "version": "1.0.0",
8
- "category": "Security Center"
9
},
10
"parameters": {
11
"effect": {
12
"type": "String",
@@ -17,9 +18,9 @@
17
"allowedValues": [
18
"AuditIfNotExists",
19
"Disabled"
20
],
21
- "defaultValue": "AuditIfNotExists"
22
}
23
},
24
"policyRule": {
25
"if": {
1
{
2
+ "displayName": "[Deprecated]: Accounts with read permissions on Azure resources should be MFA enabled",
3
"policyType": "BuiltIn",
4
"mode": "All",
5
+ "description": "This policy definition is deprecated. Learn more about policy definition deprecation at aka.ms/policydefdeprecation",
