Microsoft Entra ID tenants should have multifactor authentication enabled for all users
Ensure that 'multifactor authentication' is 'enabled' for all users. The powerpipe check ad_all_user_mfa_enabled states that a Conditional Access policy can be enabled to ensure that users are required to use Multifactor Authentication (MFA) to login.
Multifactor authentication provides additional assurance that the individual attempting to gain access is who they claim to be. With multifactor authentication, an attacker would need to compromise at least two different authentication mechanisms, increasing the difficulty of compromise and thus reducing the risk.
What this control checks
Whether Microsoft Entra ID users are covered by multifactor authentication
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.ad_user_mfa_enabled.
Framework-specific interpretation
CIS Azure Benchmark v5.0.0: Mapped to 5.1.2 (Ensure that 'multifactor authentication' is 'enabled' for all users).
Framework mappings
The clauses this control is mapped to in each framework.
- 5.1.2 Ensure that 'multifactor authentication' is 'enabled' for all users
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
ad_user_mfa_enabled - Powerpipe Control:
azure_compliance.control.ad_user_mfa_enabled
Last reviewed: 2026-10-09