Is MFA enforced on all privileged / administrative user accounts?
The hard part of this question is not the multi-factor requirement. It is agreeing on what counts as privileged, because carriers mean more roles than most organisations count.
What the carrier is actually asking
The carrier is asking whether an attacker who obtains an administrative password alone can use it. Its definition of administrative is broader than Global Administrator. It includes any role that can change identity, mail flow, security policy, or backup configuration, and it includes the service principals and automation identities that hold those permissions without being people.
Several forms sharpen this further by asking whether administrators use separate accounts for privileged work. That is a different question from whether the privileged account has MFA, and answering the second does not answer the first.
Why it is underwritten
Privileged credential compromise is the step that turns an incident into a claim. Mailbox access costs a carrier an invoice fraud loss; domain or tenant administrative access costs it a ransomware event with business interruption, forensics, and extortion cover attached. Underwriters price the second an order of magnitude higher, so they look hard at whether a single stolen admin password is sufficient on its own.
Where the answer lives in Microsoft 365, Entra ID, and Azure
In Entra ID this is measurable directly. Privileged role assignments are enumerable, and the Conditional Access policies that apply to them are enumerable, so coverage is a set comparison rather than a judgment call.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Entra ID | Roles and administrators, directory role assignments including eligible assignments in Privileged Identity Management | Every account holding a privileged directory role is enumerated, including eligible assignments that are not currently active |
| Entra ID | Conditional Access policy targeting directory roles, with authentication strength | Administrators are required to satisfy a phishing-resistant or at minimum a strong authentication strength, not merely any second factor |
| Entra ID | Exchange, SharePoint, Teams, and Intune administrator roles | Workload administrators are treated as privileged. A carrier considers an Exchange administrator who can grant mailbox delegation to be an administrator |
| Azure | Subscription and management group role assignments, Owner and User Access Administrator in particular | Azure resource-plane privilege is covered by a policy requiring multi-factor for Azure management, not only by the directory-plane policy |
| Azure | Conditional Access scoped to the Windows Azure Service Management API | Portal, CLI, PowerShell, and REST access to Azure management all evaluate the multi-factor requirement, since blocking only the portal leaves the API open |
Application and workload identities cannot present a second factor, so they are excluded from multi-factor policies by necessity. A carrier does not expect MFA on a service principal, but it does expect that a service principal holding a privileged role is inventoried, credential-managed, and not sharing a secret in a repository. If your privileged inventory only counts humans, it is incomplete.
What a defensible yes requires
- The privileged population is defined before it is measured, and the definition includes workload administrator roles, not only Global Administrator.
- Eligible role assignments in Privileged Identity Management are counted, because an eligible assignment is a privilege that activates on demand.
- Administrators satisfy a strong or phishing-resistant authentication strength rather than any available factor, since SMS on an admin account is the factor an attacker will target.
- Azure resource-plane owners are covered as well as directory-plane administrators.
- Privileged service principals are inventoried separately and their credentials are managed, so the exclusion is deliberate rather than unnoticed.
How this answer goes wrong
The common error is scope. An organisation counts its four Global Administrators, confirms all four have MFA, and answers yes, while a dozen accounts hold Exchange Administrator, Security Administrator, or Application Administrator, and two hold Owner on the production subscription. Every one of those is a route to the outcomes the carrier is underwriting.
The second error is the portal-only policy. A Conditional Access policy that targets the Azure portal application but not the Azure Service Management API leaves command-line and REST access unprotected, which is precisely the access path automated tooling and attackers use.
Frequently asked
Does the carrier mean Global Administrators only?
No. Application forms almost never define privileged, and claims review applies the practical test: could this account have caused or enabled the loss. Any role that can change authentication, mail flow, security policy, device management, or backup configuration meets that test.
Do eligible Privileged Identity Management assignments count?
Yes. An eligible assignment is a standing entitlement to privilege. If the activation path does not require multi-factor, the privilege is protected by a password alone at the moment it matters.
What about on-premises Domain Admins?
They count, and Entra ID cannot answer for them. If you run Active Directory, this answer is partly outside your Microsoft 365 tenant and needs evidence from the domain itself. Say so rather than letting the cloud evidence stand for the whole estate.
Is number matching or a hardware key required?
Not usually required to answer yes, but increasingly rewarded. Push notification fatigue attacks have moved several carriers to ask a follow-up question about factor strength for administrators specifically. Phishing-resistant factors on administrators are the cheapest way to make that follow-up easy.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture