EIDPIM-006: Privileged Users Without MFA
- Plataforma
- Entra ID / M365
- Categoría
- Entra ID Privileged Identity Management
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 4
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Privileged accounts without multi-factor authentication registered are exposed to credential-based attacks including password spraying, phishing, and brute force. A compromised privileged account without MFA provides an attacker with immediate administrative access using only a stolen password. All accounts with privileged role assignments must have strong MFA methods registered and enforced through Conditional Access policies
Valor recomendado
100% of privileged users with MFA registered and enforced via Conditional Access
Remediación
Review MFA registration status for all privileged users via Entra ID > Users > Per-user MFA or the Authentication Methods activity report. Ensure a Conditional Access policy requires MFA for all directory role assignments. Contact any privileged users lacking MFA registration and enforce registration within a defined deadline
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| partial-collection | Not Assessed |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- CISA SCuBA
- MS.AAD.3.6v1
- NIST SP 800-53
- IA-2(1), IA-2(2)
- CIS M365 Benchmark
- 5.2.2.1
- MITRE ATT&CK
- T1078, T1110