Configure Azure AD role settings in Privileged Identity Management.Conditional access: Require multifactor authentication for all users.Multifactor authentication and Privileged Identity Management With Privileged Identity Management activation requirement in place, privilege account activation isn't possible without network access, so local access is never privileged. Implement Azure AD Privileged Identity Management to require multifactor authentication for activation of privileged role assignment prior to use. Multifactor authentication for all access to privileged accounts.Ĭonfigure the following elements for a complete solution to ensure all access to privileged accounts requires multifactor authentication.Ĭonfigure conditional access policies to require multifactor authentication for all users. The information system implements multifactor authentication for local access to privileged accounts. The information system implements multifactor authentication for network access to privileged accounts. Achieving NIST authenticator assurance levels with the Microsoft identity platform.Service principals: ServicePrincipal resource type : ID propertyĪuthentication and multifactor authentication.Users: Working with users in Microsoft Graph: ID property.Azure AD provides multiple authentication methods, and you can configure methods that adhere to National Institute of Standards and Technology (NIST) authentication assurance level (AAL) 3. Uniquely identify and authenticate users or processes acting for users.Īzure AD uniquely identifies user and service principal objects directly. The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users). IA-2 User Identification and Authentication Configurations FedRAMP Control ID and description Identification and authentication (non-organizational users)Įach row in the following table provides prescriptive guidance to help you develop your organization's response to any shared responsibilities for the control or control enhancement. Identification and authentication (organizational users) The following list of controls and control enhancements in the identification and authentication (IA) family might require configuration in your Azure Active Directory (Azure AD) tenant. Identification and authentication are key to achieving a Federal Risk and Authorization Management Program (FedRAMP) High Impact level.

Microsoft authenticator