TMA-POWERPLATFORM-1.4
Ensure 'Multifactor authentication for all users' is 'Enabled'
Descripción
Enable multifactor authentication (MFA) for all users in the Microsoft 365 tenant. MFA is an authentication method which requires the user to provide two (or more) pieces of information to gain access to the system or application. There are several options for MFA within the Microsoft 365 tenant. - Authentication code received via text message to a registered mobile phone number. - Mobile authentication application like Microsoft Authenticator. Multifactor authentication requires an individual to present a minimum of two separate forms of authentication before access is granted. Multifactor authentication provides additional assurance that the individual attempting to gain access is who they claim to be. With multifactor authentication, an attacker would need to compromise at least two different authentication mechanisms, increasing the difficulty of compromise and thus reducing the r...
Cómo se verifica
Método de auditoría: Revisión manual
Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.
Verify the multifactor authentication is configured for all users. In the Microsoft 365 Admin Center: 1. Log in to https://admin.microsoft.com as a Global Administrator. 2. Go to Admin centers and click on Azure Active Directory. 3. Select Enterprise applications then, under Security, select Conditional Access. 4. Review the list of policies and ensure that there is a policy that requires the Grant access control with Require multi-factor authentication for All users under Users and groups Verify the multifactor authentication configuration for administrators, using the M365 SecureScore service: 1. Log in to the Secure Score portal https://security.microsoft.com as a Global Administrator or another custom admin role. 2. Click on Require MFA for all users policy to check MFA for all users. 3. It will show the number of users who do not have MFA configured. This information is also available via the Microsoft Graph Security API: GET https://graph.microsoft.com/beta/security/secureScores
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Enable multifactor authentication for all users. In the Microsoft 365 Admin Center: 1. Log in to https://admin.microsoft.com as a Global Administrator. 2. Go to Admin centers and click on Azure Active Directory. 3. Select Enterprise applications then, under Security, select Conditional Access. 4. Click New policy 5. Select Cloud apps or actions > All cloud apps (and don't exclude any apps) 6. Go to Assignments > Users and groups > Include > select All users (and do not exclude any user). 7. Access Controls > Grant > Require multi-factor authentication (and nothing else) 8. Conditions > Client Apps > Configure (Yes) > Explicitly select Browser, Mobile apps and desktop clients, Modern authentication clients, Exchange ActiveSync clients, and Other clients 9. Leave all other conditions blank 10. Make sure the policy is enabled 11. Create
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- authpower-platformsaas
- Referencia
- CIS Microsoft Dynamics 365 Power Platform Benchmark v1.0.1 - 1.4 Ensure 'Multifactor authentication for all users' is 'Enabled'