Microsoft recently announced a significant update to the security requirements for Azure services, introducing Multi-Factor Authentication (MFA) in two main phases:
Phase 1 (July 2024)
MFA will be gradually required for sign-ins to the Azure portal. Users must use an additional authentication method alongside their password.
Phase 2 (Early 2025)
MFA requirements will extend to Azure CLI, Azure PowerShell, and other Infrastructure as Code (IaC) tools. Automation accounts are excluded from this requirement.
To ensure readiness for this change, Microsoft recommends the following steps:
Enable MFA: If not already done, activate MFA for all user accounts immediately to protect your cloud resources.
Utilize Microsoft’s Tools: Microsoft provides various tools and guides to help implement and manage MFA. Use these resources for a smooth transition.
Identify Affected Users: Determine which users in your organization will be impacted by the new MFA requirements. Inform them about the upcoming changes and provide instructions on how to configure their accounts.
How to identify affected user accounts by the new MFA requirements
To identify which user accounts will be impacted by the new MFA requirements, follow these steps:
- Access Azure AD Sign-In Logs: Go to the Azure Active Directory (Azure AD) section in the Azure portal. Navigate to the ’Sign-ins’ logs to review user sign-in activities.
- Filter by Application: Apply filters to focus on sign-ins to the Azure portal, Azure CLI, and other relevant applications. This will help you identify users who frequently access these services.
- Check Authentication Details: Review the authentication details in the sign-in logs to see which users are not currently using MFA. Look for entries indicating single-factor authentication.
- Use PowerShell Command: Use this PowerShell command to export a list of users and their authentication methods.
- Use Conditional Access Policies: Implement Conditional Access policies to require MFA for users accessing critical resources. Monitor the policy report to see which users will be prompted for MFA under the new requirements.
Additional Resources
- Multifactor Authentication Gaps Workbook: Use this workbook to identify gaps in MFA coverage.
- App IDs for Queries:
- Azure portal: c44b4083-3bb0-49c1-b47d-974e53cbdf3c
- Azure CLI: 04b07795-8ddb-461a-bbee-02f9e1bf7b46
- Azure PowerShell: 1950a258-227b-4e31-a9cf-717495945fc2
For more detailed information and updates, visit the official Microsoft Tech Community page.