Skip to main content
Checks that MFA is enabled for all Microsoft Entra ID users.

​
About

When you connect Entra (Office 365) to DSALTA, the platform syncs your users and groups using read-only access to Microsoft Graph. On every sync, DSALTA checks whether Security Defaults are enabled or whether an enabled Conditional Access policy enforces MFA for all users. If neither condition is met, DSALTA activates this check.

​
Why This Matters

A password alone is a single point of failure. If it is phished, guessed, or reused from a breached site, an attacker gains full access. Multi-factor authentication adds a second verification step that reduces account-takeover risk and improves your overall identity security posture. It is a baseline requirement across SOC 2, ISO 27001, PCI DSS, and most security frameworks.

​
How to Fix

Before you begin
  • Ensure you have Global Administrator (or equivalent) access to your Microsoft Entra ID tenant.
Enable MFA enforcement
  1. Go to the Microsoft Entra admin center → Protection → Conditional Access → Policies.
  2. Create a policy that requires MFA for all users (or, for smaller tenants, enable Security Defaults).
  3. Scope the policy to all users and cloud apps, and set the grant control to Require multifactor authentication.
  4. Enable the policy and communicate the change to your team with an enrollment deadline.
Once Security Defaults are enabled or an enabled Conditional Access policy enforces MFA for all users, DSALTA retrieves the change on the next sync and sets the check status to Passing.

​
Frequently Asked Questions

This check runs automatically every 24 hours while the Entra (Office 365) integration is connected. You can also trigger a manual sync from Integrations in the sidebar.
A failing check appears in your Data Library → Tests dashboard. Work through the steps above; once the underlying configuration is fixed, the status updates automatically on the next sync.
Yes. If it does not apply to your environment, mark it as Not Applicable with a justification. The exclusion is documented for auditors.
No. DSALTA uses read-only access and never modifies, creates, or deletes resources. All remediation is performed by your team directly in the Microsoft Entra admin center.