Microsoft Admin Portals should require multifactor authentication
Checks that a Microsoft Entra Conditional Access policy requires multifactor authentication for Microsoft Admin Portals. The enabled policy targets All users, includes the Microsoft Admin Portals app, and enforces an MFA grant control.
Without MFA on admin portals, attackers with stolen credentials can access Microsoft 365 Admin Center, Entra Admin Center, or Exchange Admin Center to modify tenant settings, escalate privileges, and exfiltrate data. This directly impacts confidentiality, integrity, and availability of all services managed through those portals.
What this control checks
An enabled Conditional Access policy requires MFA for All users on Microsoft Admin Portals.
Audit evidence
Evidence that deployed resources meet this control: Prowler check entra_conditional_access_policy_require_mfa_for_admin_portals (prowler azure --checks entra_conditional_access_policy_require_mfa_for_admin_portals); PowerPipe control azure_compliance.control.ad_admin_portals_require_mfa.
Framework-specific interpretation
CIS Azure Benchmark v4.0.0: Mapped to 6.2.7 (Ensure that multifactor authentication is required to access Microsoft Admin Portals).
CIS Azure Benchmark v5.0.0: Mapped to 5.2.7 (Ensure that multifactor authentication is required to access Microsoft Admin Portals).
CIS Azure Benchmark v3.0.0: Mapped to 2.2.8 (Ensure Multi-factor Authentication is Required to access Microsoft Admin Portals).
Framework mappings
The clauses this control is mapped to in each framework.
- 6.2.7 Ensure that multifactor authentication is required to access Microsoft Admin Portals
- 5.2.7 Ensure that multifactor authentication is required to access Microsoft Admin Portals
- 2.2.8 Ensure Multi-factor Authentication is Required to access Microsoft Admin Portals
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
ad_admin_portals_require_mfa - Powerpipe Control:
azure_compliance.control.ad_admin_portals_require_mfa - Prowler Check:
entra_conditional_access_policy_require_mfa_for_admin_portals
Last reviewed: 2026-10-09