TMA-POWERPLATFORM-1.4

Ensure 'Multifactor authentication for all users' is 'Enabled'

보통레벨 2수동 검토power-platform

설명

Enable multifactor authentication (MFA) for all users in the Microsoft 365 tenant. MFA is an authentication method which requires the user to provide two (or more) pieces of information to gain access to the system or application. There are several options for MFA within the Microsoft 365 tenant. - Authentication code received via text message to a registered mobile phone number. - Mobile authentication application like Microsoft Authenticator. Multifactor authentication requires an individual to present a minimum of two separate forms of authentication before access is granted. Multifactor authentication provides additional assurance that the individual attempting to gain access is who they claim to be. With multifactor authentication, an attacker would need to compromise at least two different authentication mechanisms, increasing the difficulty of compromise and thus reducing the r...

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Verify the multifactor authentication is configured for all users. In the Microsoft 365 Admin Center: 1. Log in to https://admin.microsoft.com as a Global Administrator. 2. Go to Admin centers and click on Azure Active Directory. 3. Select Enterprise applications then, under Security, select Conditional Access. 4. Review the list of policies and ensure that there is a policy that requires the Grant access control with Require multi-factor authentication for All users under Users and groups Verify the multifactor authentication configuration for administrators, using the M365 SecureScore service: 1. Log in to the Secure Score portal https://security.microsoft.com as a Global Administrator or another custom admin role. 2. Click on Require MFA for all users policy to check MFA for all users. 3. It will show the number of users who do not have MFA configured. This information is also available via the Microsoft Graph Security API: GET https://graph.microsoft.com/beta/security/secureScores

조치 방법

조치 방식: 가이드 또는 인프라 패치

Enable multifactor authentication for all users. In the Microsoft 365 Admin Center: 1. Log in to https://admin.microsoft.com as a Global Administrator. 2. Go to Admin centers and click on Azure Active Directory. 3. Select Enterprise applications then, under Security, select Conditional Access. 4. Click New policy 5. Select Cloud apps or actions > All cloud apps (and don't exclude any apps) 6. Go to Assignments > Users and groups > Include > select All users (and do not exclude any user). 7. Access Controls > Grant > Require multi-factor authentication (and nothing else) 8. Conditions > Client Apps > Configure (Yes) > Explicitly select Browser, Mobile apps and desktop clients, Modern authentication clients, Exchange ActiveSync clients, and Other clients 9. Leave all other conditions blank 10. Make sure the policy is enabled 11. Create

속성

운영 체제: 모두
태그: authpower-platformsaas
참고 자료: CIS Microsoft Dynamics 365 Power Platform Benchmark v1.0.1 - 1.4 Ensure 'Multifactor authentication for all users' is 'Enabled'