EIDPIM-007: Privileged Users with Weak Authentication Methods
- Plataforma
- Entra ID / M365
- Categoría
- Entra ID Privileged Identity Management
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Privileged accounts relying on weak authentication methods such as SMS, voice call, or email OTP are vulnerable to SIM-swapping, call interception, and email compromise attacks. These legacy MFA methods do not provide the same level of assurance as phishing-resistant methods like FIDO2 security keys, Windows Hello for Business, or certificate-based authentication. Privileged accounts should be required to use phishing-resistant authentication methods exclusively
Valor recomendado
All privileged users using phishing-resistant MFA methods (FIDO2, Windows Hello for Business, or certificate-based authentication). No SMS, voice, or email OTP
Remediación
Review authentication methods registered for each privileged user via Entra ID > Authentication methods > Activity. Create a Conditional Access policy targeting privileged roles that requires authentication strength of phishing-resistant MFA. Provision FIDO2 security keys or configure Windows Hello for Business for all privileged users and remove weak methods
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- CISA SCuBA
- MS.AAD.3.6v1
- NIST SP 800-53
- IA-2(1)
- MITRE ATT&CK
- T1111, T1078