Home/Questions/Multi-factor authentication/MFA on privileged accounts
Multi-factor authentication

Is MFA enforced on all privileged / administrative user accounts?

The hard part of this question is not the multi-factor requirement. It is agreeing on what counts as privileged, because carriers mean more roles than most organisations count.

Verifiable from your tenant

What the carrier is actually asking

The carrier is asking whether an attacker who obtains an administrative password alone can use it. Its definition of administrative is broader than Global Administrator. It includes any role that can change identity, mail flow, security policy, or backup configuration, and it includes the service principals and automation identities that hold those permissions without being people.

Several forms sharpen this further by asking whether administrators use separate accounts for privileged work. That is a different question from whether the privileged account has MFA, and answering the second does not answer the first.

Why it is underwritten

Privileged credential compromise is the step that turns an incident into a claim. Mailbox access costs a carrier an invoice fraud loss; domain or tenant administrative access costs it a ransomware event with business interruption, forensics, and extortion cover attached. Underwriters price the second an order of magnitude higher, so they look hard at whether a single stolen admin password is sufficient on its own.

Where the answer lives in Microsoft 365, Entra ID, and Azure

In Entra ID this is measurable directly. Privileged role assignments are enumerable, and the Conditional Access policies that apply to them are enumerable, so coverage is a set comparison rather than a judgment call.

PlatformWhere the setting livesWhat has to be true
Entra IDRoles and administrators, directory role assignments including eligible assignments in Privileged Identity ManagementEvery account holding a privileged directory role is enumerated, including eligible assignments that are not currently active
Entra IDConditional Access policy targeting directory roles, with authentication strengthAdministrators are required to satisfy a phishing-resistant or at minimum a strong authentication strength, not merely any second factor
Entra IDExchange, SharePoint, Teams, and Intune administrator rolesWorkload administrators are treated as privileged. A carrier considers an Exchange administrator who can grant mailbox delegation to be an administrator
AzureSubscription and management group role assignments, Owner and User Access Administrator in particularAzure resource-plane privilege is covered by a policy requiring multi-factor for Azure management, not only by the directory-plane policy
AzureConditional Access scoped to the Windows Azure Service Management APIPortal, CLI, PowerShell, and REST access to Azure management all evaluate the multi-factor requirement, since blocking only the portal leaves the API open
Service principals are the usual gap

Application and workload identities cannot present a second factor, so they are excluded from multi-factor policies by necessity. A carrier does not expect MFA on a service principal, but it does expect that a service principal holding a privileged role is inventoried, credential-managed, and not sharing a secret in a repository. If your privileged inventory only counts humans, it is incomplete.

What a defensible yes requires

  • The privileged population is defined before it is measured, and the definition includes workload administrator roles, not only Global Administrator.
  • Eligible role assignments in Privileged Identity Management are counted, because an eligible assignment is a privilege that activates on demand.
  • Administrators satisfy a strong or phishing-resistant authentication strength rather than any available factor, since SMS on an admin account is the factor an attacker will target.
  • Azure resource-plane owners are covered as well as directory-plane administrators.
  • Privileged service principals are inventoried separately and their credentials are managed, so the exclusion is deliberate rather than unnoticed.

How this answer goes wrong

The common error is scope. An organisation counts its four Global Administrators, confirms all four have MFA, and answers yes, while a dozen accounts hold Exchange Administrator, Security Administrator, or Application Administrator, and two hold Owner on the production subscription. Every one of those is a route to the outcomes the carrier is underwriting.

The second error is the portal-only policy. A Conditional Access policy that targets the Azure portal application but not the Azure Service Management API leaves command-line and REST access unprotected, which is precisely the access path automated tooling and attackers use.

Frequently asked

Does the carrier mean Global Administrators only?

No. Application forms almost never define privileged, and claims review applies the practical test: could this account have caused or enabled the loss. Any role that can change authentication, mail flow, security policy, device management, or backup configuration meets that test.

Do eligible Privileged Identity Management assignments count?

Yes. An eligible assignment is a standing entitlement to privilege. If the activation path does not require multi-factor, the privilege is protected by a password alone at the moment it matters.

What about on-premises Domain Admins?

They count, and Entra ID cannot answer for them. If you run Active Directory, this answer is partly outside your Microsoft 365 tenant and needs evidence from the domain itself. Say so rather than letting the cloud evidence stand for the whole estate.

Is number matching or a hardware key required?

Not usually required to answer yes, but increasingly rewarded. Push notification fatigue attacks have moved several carriers to ask a follow-up question about factor strength for administrators specifically. Phishing-resistant factors on administrators are the cheapest way to make that follow-up easy.

Related questions

Stop answering this from memory

Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.

Assess your posture