Privileged Microsoft Entra ID users should have multifactor authentication enabled
Microsoft Entra privileged accounts are expected to use multifactor authentication. The Prowler check entra_privileged_user_has_mfa evaluates users assigned to privileged directory roles and confirms they have multiple authentication methods registered for sign-in.
Without MFA, privileged accounts face phishing, password spraying, and credential reuse risks. Compromise can grant tenant-wide admin control to alter roles, create backdoors, exfiltrate data, and weaken defenses, impacting confidentiality, integrity, and availability.
What this control checks
Privileged Microsoft Entra ID users must have multifactor authentication enabled
Audit evidence
Evidence that deployed resources meet this control: Prowler check entra_privileged_user_has_mfa (prowler azure --checks entra_privileged_user_has_mfa).
Framework-specific interpretation
PCI DSS v4.0: Mapped to 8.4.1 (Multi-factor authentication (MFA) is implemented to secure access into the CDE.), 8.4.2 (Multi-factor authentication (MFA) is implemented to secure access into the CDE.) and 8.4.3 (Multi-factor authentication (MFA) is implemented to secure access into the CDE.).
ISO/IEC 27001:2022: Mapped to A.5.17 (Authentication Information) and A.8.5 (Secure Authentication).
NIS2 Directive (EU 2022/2555): Mapped to 11.3.2.a (establish strong identification, authentication such as multi-factor authentication, and authorisation procedures for...), 11.4.2.c (protect access to system administration systems through authentication and encryption.), 11.6.2.a (ensure the strength of authentication is appropriate to the classification of the asset to be accessed;) and 3 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- 8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- 8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- 8.4.3 MFA is implemented for all remote access originating from outside the entity's network that could access or impact the CDE
- A.5.17 Authentication information
- A.8.5 Secure authentication
- 2 Risk management policy
- 3 Incident handling
- 11 Access control
- 6.1.2 Ensure that 'multifactor authentication' is 'enabled' for all users
- 5.1.2 Ensure that 'multifactor authentication' is 'enabled' for all users
- 5.2.4 Ensure that a multifactor authentication policy exists for all users
RBI Cyber Security Framework for UCBs
- Annex I (7.2)
- IAM-06.09B The cloud service provider requires two- or more factor authentication for accessing the administration interfaces used by the cloud service provider.
- IAM-08.02B Authentication credentials are managed with a security level that matches or exceeds the classification of the system component they protect.
- PSS-05.01B The cloud service provider provides authentication mechanisms that can force strong authentication (e.g. two or more factors) for users, IT components or applications within the cloud users' area of responsibility. These authentication mechanisms are set up at all access points that...
- PSS-05.02B For privileged users, IT components or applications, these authentication mechanisms are enforced.
- 1.1.2 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Privileged Users
- 1.1.2 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Privileged Users
- 2.1.2 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Privileged Users
- 164.308(a)(3)(ii)(A): Administrative Safeguards
- 164.308(a)(5)(ii)(D): Administrative Safeguards
- 164.312(a)(1) Access control
- 164.312(d) Person or entity authentication
Related controls
- Non-privileged Microsoft Entra ID users should have multifactor authentication enabled
- Microsoft Entra ID tenants should have multifactor authentication enabled for all users
- Guest users should have access reviews configured monthly
- Azure subscriptions should have more than one owner
- Virtual machines should use just-in-time network access control for management ports
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_entra_privileged_user_has_mfa - Prowler Check:
entra_privileged_user_has_mfa
Last reviewed: 2026-10-11