Back to Checks
mongodbatlas

Organization requires multi-factor authentication for user access

organizations_mfa_required
Service: organizationsSeverity: high
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

MongoDB Atlas organization mandates multi-factor authentication for all members before accessing organization resources (multi_factor_auth_required).

Prowler logoProwlerprowler-provider-mongodbatlas

Risk

Without enforced MFA, compromised passwords can grant organization access, enabling:

  • Data exposure (confidentiality)
  • Unauthorized configuration or role changes (integrity)
  • Resource deletion or disruption (availability) Increases success of phishing, brute force, and session takeover.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler mongodbatlas --checks organizations_mfa_required

Recommendation

Enforce org-wide MFA (multi_factor_auth_required). Prefer phishing-resistant factors (security keys/biometrics) over SMS, and require at least two methods for recovery. Integrate with SSO, apply least privilege, and block access until all users enroll.

Remediation

CLI

curl --digest -u "<PUBLIC_KEY>:<PRIVATE_KEY>" -H "Content-Type: application/json" -X PATCH "https://cloud.mongodb.com/api/atlas/v2/orgs/<example_resource_id>" -d '{"multiFactorAuthRequired":true}'

Other

1Sign in to MongoDB Atlas
2Select the target Organization (top-left org selector)
3Go to Organization Settings > Security > Multi-Factor Authentication
4Enable "Require Multi-Factor Authentication" for the organization
5Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportMongoDBAtlas
from prowler.providers.mongodbatlas.services.organizations.organizations_client import (
    organizations_client,
)


class organizations_mfa_required(Check):
    """Check if organization requires MFA

    This class verifies that MongoDB Atlas organizations require users
    to set up Multi-Factor Authentication (MFA) before accessing the organization.
    """

    def execute(self) -> List[CheckReportMongoDBAtlas]:
        """Execute the MongoDB Atlas organization MFA required check

        Iterates over all organizations and checks if they require users
        to set up Multi-Factor Authentication (MFA) before accessing the organization.

        Returns:
            List[CheckReportMongoDBAtlas]: A list of reports for each organization
        """
        findings = []

        for organization in organizations_client.organizations.values():
            report = CheckReportMongoDBAtlas(
                metadata=self.metadata(), resource=organization
            )

            if organization.settings.multi_factor_auth_required:
                report.status = "PASS"
                report.status_extended = (
                    f"Organization {organization.name} requires users to set up "
                    f"Multi-Factor Authentication (MFA) before accessing the organization."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Organization {organization.name} does not require users to set up "
                    f"Multi-Factor Authentication (MFA) before accessing the organization."
                )

            findings.append(report)

        return findings

References