Back to Checks
oraclecloud

User with console password has MFA enabled for console access

identity_user_mfa_enabled_console_access
Service: identitySeverity: high
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:User

OCI IAM users with console password access are expected to have multifactor authentication enabled. The evaluation inspects each local user allowed to sign in to the Console and identifies those without an active second factor.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Console-password accounts without MFA are exposed to phishing, credential stuffing, and brute force.

A stolen password can grant Console access, enabling privilege escalation, key creation, and data access-compromising confidentiality, integrity, and availability across OCI.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks identity_user_mfa_enabled_console_access

Recommendation

Require MFA for all users with Console passwords; prefer phishing-resistant authenticators (e.g., FIDO). Enforce via sign-on policies, prioritizing admins. Apply least privilege, disable Console passwords for service or federated users, and monitor auth logs to confirm ongoing MFA coverage.

Remediation

CLI

oci iam user update-user-capabilities --user-id <USER_OCID> --can-use-console-password false

Other

1Enable MFA (user action):
2- Sign in to the OCI Console as the affected user
3- Click your profile icon > User settings
4- Click "Enable Multi-Factor Authentication"
5- Scan the QR code with an authenticator app and enter the verification code, then click "Enable"
6Or, remove console access (admin action) if the user doesn't need it:
7- In the Console, go to Identity & Security > Users
8- Open the user's page > Edit user capabilities
9- Uncheck "Can use Console password" and Save

Check Code

"""Check if MFA is enabled for all users with console password."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.identity.identity_client import (
    identity_client,
)


class identity_user_mfa_enabled_console_access(Check):
    """Check if MFA is enabled for all users with console password."""

    def execute(self) -> Check_Report_OCI:
        """Execute the identity_user_mfa_enabled_console_access check.

        Returns:
            List of Check_Report_OCI objects with findings
        """
        findings = []

        for user in identity_client.users:
            # Only check users with console access
            if user.can_use_console_password:
                report = Check_Report_OCI(
                    metadata=self.metadata(),
                    resource=user,
                    region=user.region,
                    resource_name=user.name,
                    resource_id=user.id,
                    compartment_id=user.compartment_id,
                )

                if user.is_mfa_activated:
                    report.status = "PASS"
                    report.status_extended = (
                        f"User {user.name} has MFA enabled for console access."
                    )
                else:
                    report.status = "FAIL"
                    report.status_extended = f"User {user.name} has console password enabled but MFA is not activated."

                findings.append(report)

        return findings

References