EIDPIM-006: Privileged Users Without MFA
- Platform
- Entra ID / M365
- Category
- Entra ID Privileged Identity Management
- Severity
- Critical
- Zero Trust pillar
- Identity (weight 3)
- Golden fixtures
- 4
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Privileged accounts without multi-factor authentication registered are exposed to credential-based attacks including password spraying, phishing, and brute force. A compromised privileged account without MFA provides an attacker with immediate administrative access using only a stolen password. All accounts with privileged role assignments must have strong MFA methods registered and enforced through Conditional Access policies
Recommended value
100% of privileged users with MFA registered and enforced via Conditional Access
Remediation
Review MFA registration status for all privileged users via Entra ID > Users > Per-user MFA or the Authentication Methods activity report. Ensure a Conditional Access policy requires MFA for all directory role assignments. Contact any privileged users lacking MFA registration and enforce registration within a defined deadline
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| partial-collection | Not Assessed |
| throttled | Not Assessed |
Framework mappings
- CISA SCuBA
- MS.AAD.3.6v1
- NIST SP 800-53
- IA-2(1), IA-2(2)
- CIS M365 Benchmark
- 5.2.2.1
- MITRE ATT&CK
- T1078, T1110