In response to increasing controversy around its cybersecurity practices, Microsoft has decided to implement mandatory multi-factor authentication (MFA) for all Azure users, aiming to enhance security and address concerns raised by the cybersecurity community.
This change will significantly impact how users sign into the Azure portal, CLI, PowerShell, and various IaC tools. This blog post aims to provide clarity on the timing, scope, and implementation of this new requirement and offer guidance on how to prepare your organization for these changes.
Summary of the changes in Azure
The enforcement of MFA will be rolled out in two phases:
Phase 1 (July 2024): MFA enforcement will begin for users signing into the Azure portal. This phase will not impact other Azure clients, such as CLI, PowerShell, or IaC tools.
Phase 2 (Early 2025): MFA enforcement will extend to Azure CLI, PowerShell, and IaC tools.
Microsoft will notify global admins 60 days in advance of the enforcement date for their tenants, with periodic reminders leading up to the enforcement.
If you already have MFA set up through Microsoft’s security defaults or Conditional Access policies, there will be minimal changes for your users. The MFA requirement supports all currently available methods, including external MFA solutions.
What this means for your organization
The MFA requirement is mandatory for all organizations, but those with more complex environments can apply for a grace period if they need more time to comply. While the new changes will present a technical challenge for administrators, they are a necessary measure in today’s climate of regular cyber incidents and breaches.
MFA will provide much-needed security for the sensitive assets you store in Azure and help you comply with industry regulations and standards, such as GDPR, HIPAA, and PCI DSS, which all require the implementation of MFA to secure assets.
That’s precisely why we added MFA as one of the key measures to enhance security (as part of the Access Control and Identity Management security control). Read our eBook to discover more strategies on how to protect your business.
Action steps
- Identify impacted users: Use PowerShell commands and the Multifactor Authentication Gaps workbook to identify users who need to transition to MFA.
- Set up MFA: Implement MFA for all relevant user accounts using the MFA wizard for Microsoft Entra.
- Migrate automation accounts: Transition user identities used in automation to managed identities or service principals.
- Review break glass accounts: Update break glass or “emergency access” accounts to use FIDO2 or certificate-based authentication. Either of these methods will satisfy the MFA requirement.
For more details, please read the official update post from Microsoft.
Why MFA is critical for your security
The most common password in the world is still '123456,' which highlights the ongoing risk of weak password practices. Even with complex passwords, cybercriminals have sophisticated methods to breach accounts. Implementing Multi-Factor Authentication (MFA) significantly strengthens your security posture, making you much less likely to be hacked.
MFA is a layered approach to securing data and applications. It requires users to provide two or more credentials to verify their identity. This added layer of protection ensures that even if one credential is compromised, unauthorized users cannot meet the second authentication requirement, thereby preventing access to sensitive resources.
Given the sophistication of current cyber threats, adopting MFA is not just a best practice but a necessity. By mandating MFA, Microsoft will enhance the security of Azure environments, ensuring that only authenticated users can access critical resources. This proactive measure will safeguard your organization against unauthorized access, protecting valuable data and systems from potential breaches.
Need assistance? Get in touch with us
Navigating new requirements can present technical difficulties that are hard to tackle without a dedicated team.
We provide comprehensive support and customized solutions to ensure your organization seamlessly implements MFA and maintains strong security protocols. Additionally, we offer training to help your users understand the importance of MFA and how to use it effectively.
Contact us today to schedule a free consultation and get started on enhancing your Azure security.