Back to Checks
azure

Conditional Access policy requires MFA for Microsoft Admin Portals

entra_conditional_access_policy_require_mfa_for_admin_portals
Service: entraSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Microsoft Entra Conditional Access is evaluated for a policy that requires multifactor authentication when accessing Microsoft Admin Portals (Microsoft 365 Admin Center, Microsoft Entra Admin Center, Microsoft Exchange Admin Center, etc.). The check confirms an enabled policy targets All users, includes the Microsoft Admin Portals app, and enforces an MFA grant control.

Prowler logoProwlerprowler-provider-azure

Risk

Without MFA on admin portals, attackers with stolen credentials can access Microsoft 365 Admin Center, Entra Admin Center, or Exchange Admin Center to modify tenant settings, escalate privileges, and exfiltrate data. This directly impacts confidentiality, integrity, and availability of all services managed through those portals.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks entra_conditional_access_policy_require_mfa_for_admin_portals

Recommendation

Create a Conditional Access policy that requires MFA for the Microsoft Admin Portals app targeting All users. Exclude only break-glass emergency accounts and non-interactive service principals. Test in Report-only mode before enforcing. Prefer phishing-resistant MFA methods (FIDO2, passkeys) and apply least privilege principles.

Remediation

Terraform

resource "azuread_conditional_access_policy" "<example_resource_name>" {
  display_name = "<example_resource_name>"
  state        = "enabled"

  conditions {
    users {
      included_users = ["All"]
      excluded_users = ["<break_glass_account_id>"]
    }
    applications {
      included_applications = ["MicrosoftAdminPortals"]  # Critical: Microsoft Admin Portals
    }
  }

  grant_controls {
    operator          = "OR"
    built_in_controls = ["mfa"]  # Critical: requires MFA
  }
}

Other

1Sign in to the Microsoft Entra admin center
2Go to Protection > Conditional Access > Policies
3Click + New policy and enter a name
4Under Users > Include, select All users
5Under Exclude, check Users and groups and select break-glass / non-interactive service accounts
6Under Target resources > Include, click Select apps, then select Microsoft Admin Portals
7Under Grant, select Grant access and check Require multifactor authentication
8Set Enable policy to Report-only, click Create
9After testing, change Enable policy from Report-only to On

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.config import MICROSOFT_ADMIN_PORTALS
from prowler.providers.azure.services.entra.entra_client import entra_client


class entra_conditional_access_policy_require_mfa_for_admin_portals(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            tenant_name,
            conditional_access_policies,
        ) in entra_client.conditional_access_policy.items():
            for policy in conditional_access_policies.values():
                if (
                    policy.state == "enabled"
                    and "All" in policy.users["include"]
                    and MICROSOFT_ADMIN_PORTALS in policy.target_resources["include"]
                    and any(
                        "mfa" in access_control.lower()
                        for access_control in policy.access_controls["grant"]
                    )
                ):
                    report = Check_Report_Azure(
                        metadata=self.metadata(), resource=policy
                    )
                    report.subscription = f"Tenant: {tenant_name}"
                    report.status = "PASS"
                    report.status_extended = "Conditional Access Policy requires MFA for Microsoft Admin Portals."
                    break
            else:
                report = Check_Report_Azure(
                    metadata=self.metadata(),
                    resource=conditional_access_policies,
                )
                report.subscription = f"Tenant: {tenant_name}"
                report.resource_name = "Conditional Access Policy"
                report.resource_id = "Conditional Access Policy"
                report.status = "FAIL"
                report.status_extended = "Conditional Access Policy does not require MFA for Microsoft Admin Portals."

            findings.append(report)

        return findings

References