All admin role assignments must have MFA registered

Requirement

Every user assigned a privileged admin role in Entra ID (Global Admin, Privileged Role Admin, Security Admin, Conditional Access Admin, etc.) must have multi-factor authentication registered. Conditional Access must enforce MFA at sign-in for these roles.

Remediation guidance

Identify the admin without MFA. Enrol them via Microsoft Authenticator or hardware token. Audit the Conditional Access policy "Require MFA for admins" — it should be in state=enabled and include all admin roleTemplateIds.

Evidence specification

{
  "query": "admin_role_assignments",
  "required_fields": [
    "roleTemplateId",
    "displayName",
    "members"
  ]
}

Recent evaluations (Apollo Gaming Ltd.)