lacework-global-514
1.1.2 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Privileged Users (Manual)
Profile Applicability
• Level 1
Description
Enable multi-factor authentication for all roles, groups, and users that have write access or permissions to Azure resources. These include custom created objects or built-in roles such as;
- Service Co-Administrators
- Subscription Owners
- Contributors
Rationale
Multi-factor authentication requires an individual to present a minimum of two separate forms of authentication before access is granted. Multi-factor authentication provides additional assurance that the individual attempting to gain access is who they claim to be. With multi-factor authentication, an attacker would need to compromise at least two different authentication mechanisms, increasing the difficulty of compromise and thus reducing the risk.
Impact
Users would require two forms of authentication before any access is granted. Additional administrative time will be required for managing dual forms of authentication when enabling multi-factor authentication.
Audit
From Azure Portal
- From Azure Home select the Portal Menu
- Select the
Azure Active Directory
blade - Then
Users
All Users
- Click on the
Per-User MFA
button in the top row menu - Ensure that
MULTI-FACTOR AUTH STATUS
isEnabled
for all users who areService Co-Administrators
,Owners
, ORContributors
.
From Azure REST API
For Every Subscription, For Every Tenant
Step 1: Identify Users with Administrative Access
- List All Users Using Microsoft Graph API:
GET https://graph.microsoft.com/v1.0/users
Capture id
and corresponding userPrincipalName
('$uid', '$userPrincipalName')
- List all Role Definitions Using Azure management API:
https://management.azure.com/subscriptions/:subscriptionId/providers/Microsoft.Authorization/roleDefinitions?api-version=2017-05-01
Capture Role Definition IDs/Name ('$name') and role names ('$properties/roleName') where "properties/roleName" contains (Owner
or *contributor
or admin
)
- List All Role Assignments (Mappings
$A.uid
to$B.name
) Using Azure Management API:
GET https://management.azure.com/subscriptions/:subscriptionId/providers/Microsoft.Authorization/roleassignments?api-version=2017-10-01-preview
Find all administrative roles ($B.name
) in "Properties/roleDefinitionId"
mapped with user ids ($A.id
) in "Properties/principalId"
where "Properties/principalType" == "User"
- Now Match (
$CProperties/principalId
) with$A.uid
and get$A.userPrincipalName
save this asD.userPrincipalName
Step 2: Run MSOL Powershell command:
Get-MsolUser -All | where {$_.StrongAuthenticationMethods.Count -eq 0} | Select-Object -Property UserPrincipalName
If the output contains any of the $D.userPrincipalName
, then this recommendation is non-compliant.
Please note that at the time of writing, there is no API, Azure CLI or Powershell mechanism available to programmatically conduct security assessment or remediation for this recommendation. The only option is MSOL.
Remediation
From Azure Portal
- From Azure Home select the Portal Menu
- Select
Azure Active Directory
blade - Then
Users
- Select
All Users
- Click on the
Per-User MFA button
in the top row menu - Select each user individually with the role
Service Co-Administrators
,Owners
, ORContributors
in the columnMULTI-FACTOR AUTH STATUS
- In the information box on the right side under the title
quick steps
clickenable
Other Options within Azure Portal
Follow Microsoft Azure documentation and enable multi-factor authentication in your environment.
https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-azure-mfa
Enabling and configuring MFA with conditional access policy is a multi-step process. Here are some additional resources on the process within Azure AD to enable multi-factor authentication for users within your subscriptions with conditional access policy.
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings
Please note that at the time of writing, there is no API, Azure CLI or Powershell mechanism available to programmatically conduct security assessment or remediation for this recommendation. The only option is MSOL.
References
https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication
https://stackoverflow.com/questions/41156206/azure-active-directory-premium-mfa-attributes-via-graph-api
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-identity-management#im-4-use-strong-authentication-controls-for-all-azure-active-directory-based-access
Additional Information
Please note that at the time of writing, there is no API, Azure CLI or Powershell mechanism available to programmatically conduct security assessment or remediation for this recommendation. The only option is MSOL.