Menu
Ensure multifactor authentication is required for risky sign-ins
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-azure-foundations-5-2-5The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Based on SOC occupation classification
Showing SKILL.md
| name | cis-azure-foundations-5.2.5 |
| description | Ensure multifactor authentication is required for risky sign-ins |
| category | cis-azure-foundations |
| version | 5.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","identity","conditional-access"] |
| cis_id | 5.2.5 |
| cis_benchmark | CIS Microsoft Azure Foundations Benchmark v5.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | ["cis-azure-foundations-5.2.4","cis-azure-foundations-5.2.6"] |
| prerequisites | [] |
| severity_boost | {} |
Entra ID tracks the behavior of sign-in events. If the Entra ID domain is licensed with P2, the sign-in behavior can be used as a detection mechanism for additional scrutiny during the sign-in event. If this policy is set up, then Risky Sign-in events will prompt users to use multi-factor authentication (MFA) tokens on login for additional verification.
Enabling multi-factor authentication is a recommended setting to limit the potential of accounts being compromised and limiting access to authenticated personnel. Enabling this policy allows Entra ID's risk-detection mechanisms to force additional scrutiny on the login event, providing a deterrent response to potentially malicious sign-in events, and adding an additional authentication layer as a reaction to potentially malicious behavior.
Risk Policies for Conditional Access require Microsoft Entra ID P2. Additional overhead to support or maintain these policies may also be required if users lose access to their MFA tokens.
Microsoft Entra ID.Security.Conditional Access.Policies.Users.Include the corresponding users and groups to whom the policy is applied.Exclude to determine which users and groups to whom the policy is not applied.A Conditional Access policy should exist that requires MFA for risky sign-ins, targeting all users with all cloud apps, with sign-in risk conditions set to High and Medium, and the Grant control set to Require multifactor authentication with sign-in frequency set to Every time.
Microsoft Entra ID.Security.Conditional Access.Policies.+ New policy.Users.Include, select All users.Exclude, check Users and groups.Select.Target resources.All cloud apps.Conditions.Sign-in risk.Configure toggle to Yes.High and Medium.Done.Grant and check Require multifactor authentication then click the Select button.Session then check Sign-in frequency and select Every time and click the Select button.Enable policy to Report-only.Create.After testing the policy in report-only mode, update the Enable policy setting from Report-only to On.
MFA is not enabled by default.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 6.3 Require MFA for Externally-Exposed Applications | x | x | |
| v8 | 6.4 Require MFA for Remote Network Access | x | x | x |
| v8 | 6.7 Centralize Access Control | x | x | |
| v7 | 16.3 Require Multi-factor Authentication | x | x |
Level 2 | Manual