Non-privileged Microsoft Entra ID users should have multifactor authentication enabled
Microsoft Entra non-privileged users are assessed for multifactor authentication. The check verifies they have two or more registered authentication methods (MFA enrollment).
Absent MFA on standard accounts enables password-only logins after phishing, reuse, or spraying, leading to account takeover. Attackers can access email, files, and apps, send internal phishing, and escalate, undermining confidentiality and integrity, and risking availability via malicious changes.
What this control checks
Non-privileged Entra users pass with two or more registered authentication methods (MFA enrollment).
Audit evidence
Evidence that deployed resources meet this control: Prowler check entra_non_privileged_user_has_mfa (prowler azure --checks entra_non_privileged_user_has_mfa).
Framework-specific interpretation
PCI DSS v4.0: Mapped to 8.4.1 (Multi-factor authentication (MFA) is implemented to secure access into the CDE.), 8.4.2 (Multi-factor authentication (MFA) is implemented to secure access into the CDE.) and 8.4.3 (Multi-factor authentication (MFA) is implemented to secure access into the CDE.).
ISO/IEC 27001:2022: Mapped to A.5.17 (Authentication Information) and A.8.5 (Secure Authentication).
NIS2 Directive (EU 2022/2555): Mapped to 11.3.2.a (establish strong identification, authentication such as multi-factor authentication, and authorisation procedures for...), 11.6.2.a (ensure the strength of authentication is appropriate to the classification of the asset to be accessed;) and 11.7.2 (The relevant entities shall ensure that the strength of authentication is appropriate for the classification of the...).
Framework mappings
The clauses this control is mapped to in each framework.
- 8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- 8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- 8.4.3 MFA is implemented for all remote access originating from outside the entity's network that could access or impact the CDE
- A.5.17 Authentication information
- A.8.5 Secure authentication
- 11 Access control
- 6.1.2 Ensure that 'multifactor authentication' is 'enabled' for all users
- 5.1.2 Ensure that 'multifactor authentication' is 'enabled' for all users
- 5.2.4 Ensure that a multifactor authentication policy exists for all users
RBI Cyber Security Framework for UCBs
- Annex I (7.2)
- IAM-09.01AC Access to the non-production environment requires two-factor or multi-factor authentication.
- PSS-05.01B The cloud service provider provides authentication mechanisms that can force strong authentication (e.g. two or more factors) for users, IT components or applications within the cloud users' area of responsibility. These authentication mechanisms are set up at all access points that...
- 1.1.3 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Non-Privileged Users
- 1.1.3 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Non-Privileged Users
- 2.1.3 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Non-Privileged Users
- 164.308(a)(3)(ii)(A): Administrative Safeguards
- 164.308(a)(5)(ii)(D): Administrative Safeguards
- 164.312(d) Person or entity authentication
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_entra_non_privileged_user_has_mfa - Prowler Check:
entra_non_privileged_user_has_mfa
Last reviewed: 2026-10-11