Identity and access

MFA required for active accounts

Explanation
Definition

Each selected account should have MFA registered.Part of Alignr Baseline (seeded).Applies toAccounts observed as enabled.What the result tells youThis checks MFA registration, not effective enforcement at every sign-in. Review policy coverage, allowed methods and emergency exclusions separately.

Setting	Value
Standard	Alignr Baseline (seeded)
Severity	High
Declared autonomy	Document only

Population conditionAccount enabled (account_enabled) equals true.Expected evidence

MFA registered (mfa_registered) equals true.

Required predicates: account_enabled, mfa_registered.

{
  "match": {
    "predicate": "account_enabled",
    "object": true
  },
  "expect": [
    {
      "fact": "mfa_registered",
      "op": "eq",
      "value": true
    }
  ],
  "severity": "high",
  "title": "Active account has no MFA registered",
  "evidence": [
    "account_enabled",
    "mfa_registered"
  ]
}

Privileged roles require MFA

Explanation
Definition

Each selected account should have MFA registered.Part of Alignr Baseline (seeded).Applies toAccounts observed with the Global Administrator role.What the result tells youThis checks MFA registration, not effective enforcement at every sign-in. Review policy coverage, allowed methods and emergency exclusions separately.

Setting	Value
Standard	Alignr Baseline (seeded)
Severity	High
Declared autonomy	Change ticket

Population conditionDirectory role (has_role) equals "Global Administrator".Expected evidence

MFA registered (mfa_registered) equals true.

Required predicates: has_role, mfa_registered.

{
  "match": {
    "predicate": "has_role",
    "object": "Global Administrator"
  },
  "expect": [
    {
      "fact": "mfa_registered",
      "op": "eq",
      "value": true
    }
  ],
  "severity": "high",
  "title": "Privileged role holder has no MFA registered",
  "evidence": [
    "has_role",
    "mfa_registered"
  ]
}

Dormant accounts are disabled

Explanation
Definition

Accounts selected by the inactivity filter should be disabled.Part of Alignr Baseline (seeded).Applies toAccounts with an enabled-state observation.Only accounts whose recorded last sign-in is older than the configured inactivity limit are selected.Default settings

Setting	Default	Allowed range
Dormant after (days)	`90`	1–365

Client overrides can change these values. Check the effective settings when interpreting a result.What the result tells youReview the selected account population and its business purpose before acting. An automated disabled-state expectation does not authorise disabling an account.

Setting	Value
Standard	Alignr Baseline (seeded)
Severity	High
Declared autonomy	Change ticket

Population conditionAccount enabled (account_enabled) has an observation.

Filter: Last interactive sign-in (last_sign_in) is more than this many days in the past: parameter dormant_days.

Expected evidence

Account enabled (account_enabled) equals false.

Required predicates: account_enabled, last_sign_in.

{
  "match": {
    "predicate": "account_enabled"
  },
  "where": [
    {
      "fact": "last_sign_in",
      "op": "older_than_days",
      "value": {
        "param": "dormant_days"
      }
    }
  ],
  "expect": [
    {
      "fact": "account_enabled",
      "op": "eq",
      "value": false
    }
  ],
  "severity": "high",
  "title": "Dormant account is still enabled",
  "evidence": [
    "account_enabled",
    "last_sign_in"
  ]
}

Conditional access is enforced tenant-wide

Explanation
Definition

Each selected policy should be enabled.Part of Alignr Baseline (seeded).Applies toConditional Access policies observed with an All users scope.What the result tells youThe title is broader than the measured condition: an observed All users policy being enabled does not establish all policy interactions, exclusions or sign-in enforcement.

Setting	Value
Standard	Alignr Baseline (seeded)
Severity	Medium
Declared autonomy	Suggest only

Population conditionPolicy scope (ca_policy_scope) equals "All users".Expected evidence

Policy state (ca_policy_state) equals "enabled".

Required predicates: ca_policy_scope, ca_policy_state.

{
  "match": {
    "predicate": "ca_policy_scope",
    "object": "All users"
  },
  "expect": [
    {
      "fact": "ca_policy_state",
      "op": "eq",
      "value": "enabled"
    }
  ],
  "severity": "medium",
  "title": "Tenant-wide conditional access policy is not enforced",
  "evidence": [
    "ca_policy_scope",
    "ca_policy_state"
  ]
}

No MFA bypass in effect

Explanation
Definition

MFA bypass should be off for each selected account.Part of Alignr Baseline (seeded).Applies toSubjects with a recorded mfa bypass enabled observation.What the result tells youA registered factor and an active bypass can coexist. Review approved emergency access and any temporary exception before changing the account.

Setting	Value
Standard	Alignr Baseline (seeded)
Severity	High
Declared autonomy	One click

Population conditionMFA bypass enabled (mfa_bypass_enabled) has an observation.Expected evidence

MFA bypass enabled (mfa_bypass_enabled) equals false.

Required predicates: mfa_bypass_enabled.

{
  "match": {
    "predicate": "mfa_bypass_enabled"
  },
  "expect": [
    {
      "fact": "mfa_bypass_enabled",
      "op": "eq",
      "value": false
    }
  ],
  "severity": "high",
  "title": "Account has an active MFA bypass",
  "evidence": [
    "mfa_bypass_enabled"
  ]
}

MFA on active accounts

Explanation
Definition

Each selected account should have MFA registered.Part of BIOS Identity Assurance.Applies toAccounts observed as enabled.What the result tells youThis checks MFA registration, not effective enforcement at every sign-in. Review policy coverage, allowed methods and emergency exclusions separately.

Setting	Value
Standard	BIOS Identity Assurance
Severity	High
Declared autonomy	Suggest only

Population conditionAccount enabled (account_enabled) equals true.Expected evidence

MFA registered (mfa_registered) equals true.

Required predicates: account_enabled, mfa_registered.

{
  "match": {
    "predicate": "account_enabled",
    "object": true
  },
  "expect": [
    {
      "fact": "mfa_registered",
      "op": "eq",
      "value": true
    }
  ],
  "severity": "high",
  "title": "Active account lacks MFA",
  "evidence": [
    "account_enabled",
    "mfa_registered"
  ]
}

Global Administrators use MFA

Explanation
Definition

Each selected account should have MFA registered.Part of BIOS Identity Assurance.Applies toAccounts observed with the Global Administrator role.What the result tells youThis checks MFA registration, not effective enforcement at every sign-in. Review policy coverage, allowed methods and emergency exclusions separately.

Setting	Value
Standard	BIOS Identity Assurance
Severity	High
Declared autonomy	Suggest only

Population conditionDirectory role (has_role) equals "Global Administrator".Expected evidence

MFA registered (mfa_registered) equals true.

Required predicates: has_role, mfa_registered.

{
  "match": {
    "predicate": "has_role",
    "object": "Global Administrator"
  },
  "expect": [
    {
      "fact": "mfa_registered",
      "op": "eq",
      "value": true
    }
  ],
  "severity": "high",
  "title": "Global Administrator lacks MFA",
  "evidence": [
    "has_role",
    "mfa_registered"
  ]
}

Review effective conditional access coverage

Review every 90 days · BIOS Identity AssuranceVerify the intended account population is covered by enabled policies, required grant controls and approved emergency exclusions. Review policy interactions and test sign-in enforcement. Registration or an enabled policy alone does not prove MFA enforcement.Record: who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.

Review break-glass account governance

Review every 90 days · BIOS Identity AssuranceConfirm named emergency accounts, exclusions, monitoring and last access test against the approved policy.Record: who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.

Start here

Explore Alignr

Identity and access

Automated controls

Manual checks

Investigate a result

Next steps

​Automated controls

​Manual checks

​Investigate a result

​Next steps

Automated controls

Manual checks

Investigate a result

Next steps