cis-azure-foundations-3-1-1

name	cis-azure-foundations-3.1.1
description	Ensure only MFA enabled identities can access privileged Virtual Machine
category	cis-azure-foundations
version	5.0.0
author	cyberstrike-official
tags	["cis","azure","virtual-machines","vm"]
cis_id	3.1.1
cis_benchmark	CIS Microsoft Azure Foundations Benchmark v5.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure only MFA enabled identities can access privileged Virtual Machine

Description

Verify identities without MFA that can log in to a privileged virtual machine using separate login credentials. An adversary can leverage the access to move laterally and perform actions with the virtual machine's managed identity. Make sure the virtual machine only has necessary permissions, and revoke the admin-level permissions according to the principle of least privilege.

Rationale

Integrating multi-factor authentication (MFA) as part of the organizational policy can greatly reduce the risk of an identity gaining control of valid credentials that may be used for additional tactics such as initial access, lateral movement, and collecting information. MFA can also be used to restrict access to cloud resources and APIs.

An Adversary may log into accessible cloud services within a compromised environment using Valid Accounts that are synchronized to move laterally and perform actions with the virtual machine's managed identity. The adversary may then perform management actions or access cloud-hosted resources as the logged-on managed identity.

Impact

This recommendation requires the Entra ID P2 license to implement.

Ensure that identities provisioned to a virtual machine utilize an RBAC/ABAC group and are allocated a role using Azure PIM, and that the role settings require MFA or use another third-party PAM solution for accessing virtual machines.

Audit Procedure

Audit from Azure Portal

1. Log in to the Azure portal.
2. Select the Subscription, then click on Access control (IAM).
3. Click Role : All and click All to display the drop-down menu.
4. Type Virtual Machine Administrator Login and select Virtual Machine Administrator Login.
5. Review the list of identities that have been assigned the Virtual Machine Administrator Login role.
6. Go to Microsoft Entra ID.
7. For Per-user MFA: a) Under Manage, click Users. b) Click Per-user MFA. c) Ensure that none of the identities assigned the Virtual Machine Administrator Login role from step 4 have Status set to disabled.
8. For Conditional Access: a) Under Manage, click Security. b) Under Protect, click Conditional Access. c) Ensure that none of the identities assigned the role from step 4 are exempt from a Conditional Access policy requiring MFA for all users.