> ## Documentation Index
> Fetch the complete documentation index at: https://help.dsalta.com/llms.txt
> Use this file to discover all available pages before exploring further.

# MFA should be enabled for all users

> Checks that MFA is enabled for all Microsoft Entra ID users.

Checks that MFA is enabled for all Microsoft Entra ID users.

## About

When you connect Entra (Office 365) to DSALTA, the platform syncs your users and groups using read-only access to Microsoft Graph. On every sync, DSALTA checks whether Security Defaults are enabled or whether an enabled Conditional Access policy enforces MFA for all users. If neither condition is met, DSALTA activates this check.

## Why This Matters

A password alone is a single point of failure. If it is phished, guessed, or reused from a breached site, an attacker gains full access. Multi-factor authentication adds a second verification step that reduces account-takeover risk and improves your overall identity security posture. It is a baseline requirement across SOC 2, ISO 27001, PCI DSS, and most security frameworks.

## How to Fix

**Before you begin**

* Ensure you have **Global Administrator** (or equivalent) access to your Microsoft Entra ID tenant.

**Enable MFA enforcement**

1. Go to the **Microsoft Entra admin center → Protection → Conditional Access → Policies**.
2. Create a policy that requires MFA for **all users** (or, for smaller tenants, enable **Security Defaults**).
3. Scope the policy to all users and cloud apps, and set the grant control to **Require multifactor authentication**.
4. Enable the policy and communicate the change to your team with an enrollment deadline.

Once Security Defaults are enabled or an enabled Conditional Access policy enforces MFA for all users, DSALTA retrieves the change on the next sync and sets the check status to **Passing**.

## Frequently Asked Questions

<AccordionGroup>
  <Accordion title="How often does this check run?">
    This check runs automatically every 24 hours while the Entra (Office 365) integration is connected. You can also trigger a manual sync from **Integrations** in the sidebar.
  </Accordion>

  <Accordion title="What happens if it keeps failing?">
    A failing check appears in your **Data Library → Tests** dashboard. Work through the steps above; once the underlying configuration is fixed, the status updates automatically on the next sync.
  </Accordion>

  <Accordion title="Can I exclude this check?">
    Yes. If it does not apply to your environment, mark it as **Not Applicable** with a justification. The exclusion is documented for auditors.
  </Accordion>

  <Accordion title="Does DSALTA change my Office 365 configuration?">
    No. DSALTA uses **read-only access** and never modifies, creates, or deletes resources. All remediation is performed by your team directly in the Microsoft Entra admin center.
  </Accordion>
</AccordionGroup>