Enable MFA on Microsoft Entra ID accounts that have administrator roles

The platform identifies Microsoft Entra ID administrator accounts without Multi-Factor Authentication (MFA) enabled and recommends implementing MFA for all accounts with administrator roles. Failure to implement MFA on administrator accounts creates significant security vulnerabilities, as compromised admin credentials could lead to severe security breaches, data loss, and operational disruption.

Recommendation Impact Across KPIs

KPI	Impact	Calculated?
Reliability:	No direct reliability impact measured	❌
Security Compliance:	PRIMARY REC - Direct impact on NIST compliance scoring and overall security posture	✅
Economic:	No direct economic impact measured	❌
User Experience:	No direct user experience impact measured	❌
Environment:	No direct environmental impact measured	❌

Score Calculation

1. Data Ingestion

Asset Type: User
Current MFA Status
Administrative Role Assignment
Number of administrators with/without MFA

2. Data Enrichment

Mapping to NIST compliance requirements
MFA implementation status
Administrator role classification

3. Health Score

Calculate the Security Compliance score using: (NIST Score * NIST Asset Weight) * Multiplier for length of compliance
Source: DataTable-NIST

Example Graph

Pie chart showing the distribution of administrators with and without MFA enabled, providing a clear visual representation of the current security compliance status for administrative accounts.

Business Opportunities

Product Sales Opportunity

As a provider this recommendation presents opportunities to sell MFA tools and licenses for ongoing protection of administrator accounts.

Professional Services Opportunity

The recommendation provides an opportunity for professional services to implement and configure MFA for Microsoft Entra ID administrator accounts. This includes setup, configuration, and training for affected administrators.

Remediation Guidance

To resolve the recommendation the following steps are recommended:

Develop an MFA Implementation Plan
Identify Administrator Accounts
Assess MFA Requirements
Allocate Resources

Establish a Timeline

Communicate with Administrators

Notify Affected Admins
Provide Guidance

Schedule Implementation

Execute MFA Activation

Enable MFA via Entra ID Portal
Configure Authentication Methods

Enforce MFA Policies

Post-Implementation Monitoring & Support

Monitor MFA Enrollment
Address Issues

Review Admin Access

Ongoing Maintenance

Periodic Checks
Enforce Best Practices

Supporting Information

Supported Data Sources

Microsoft Graph Entra ID

Recommendation Categorisation

Security
Compliance
Identity Management

Supported Instances

Microsoft Entra ID (Azure AD)

Planned Instances

Status: In Development
Implementation Type: New
Category: Reconfigure