> ## Documentation Index
> Fetch the complete documentation index at: https://docs.alignr.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Identity and access
> Accounts, MFA registration, Conditional Access and privileged-access reviews.
This category contains **7 automated control definitions** and **3 manual checks** across the sources named below. Similar controls from different standards are listed separately because names, thresholds or severity can differ.
Whether the seeded Alignr Baseline is available depends on how your workspace was provisioned. Library templates are copied as disabled drafts. See [Choose a baseline](/controls/baselines/overview) before enabling anything.
## Automated controls
Expand a control to see the exact population, expectation and defaults. A pass requires usable evidence for the selected population. A known contrary observation can prove failure; missing observations or an empty population must not become a pass.
Each selected account should have MFA registered.
Part of **Alignr Baseline (seeded)**.
**Applies to**
Accounts observed as enabled.
**What the result tells you**
This checks MFA registration, not effective enforcement at every sign-in. Review policy coverage, allowed methods and emergency exclusions separately.
| Setting | Value |
| ----------------- | ------------------------ |
| Standard | Alignr Baseline (seeded) |
| Severity | High |
| Declared autonomy | Document only |
**Population condition**
**Account enabled** (`account_enabled`) equals `true`.
**Expected evidence**
* **MFA registered** (`mfa_registered`) equals `true`.
**Required predicates:** `account_enabled`, `mfa_registered`.
```json theme={null}
{
"match": {
"predicate": "account_enabled",
"object": true
},
"expect": [
{
"fact": "mfa_registered",
"op": "eq",
"value": true
}
],
"severity": "high",
"title": "Active account has no MFA registered",
"evidence": [
"account_enabled",
"mfa_registered"
]
}
```
Each selected account should have MFA registered.
Part of **Alignr Baseline (seeded)**.
**Applies to**
Accounts observed with the Global Administrator role.
**What the result tells you**
This checks MFA registration, not effective enforcement at every sign-in. Review policy coverage, allowed methods and emergency exclusions separately.
| Setting | Value |
| ----------------- | ------------------------ |
| Standard | Alignr Baseline (seeded) |
| Severity | High |
| Declared autonomy | Change ticket |
**Population condition**
**Directory role** (`has_role`) equals `"Global Administrator"`.
**Expected evidence**
* **MFA registered** (`mfa_registered`) equals `true`.
**Required predicates:** `has_role`, `mfa_registered`.
```json theme={null}
{
"match": {
"predicate": "has_role",
"object": "Global Administrator"
},
"expect": [
{
"fact": "mfa_registered",
"op": "eq",
"value": true
}
],
"severity": "high",
"title": "Privileged role holder has no MFA registered",
"evidence": [
"has_role",
"mfa_registered"
]
}
```
Accounts selected by the inactivity filter should be disabled.
Part of **Alignr Baseline (seeded)**.
**Applies to**
Accounts with an enabled-state observation.
Only accounts whose recorded last sign-in is older than the configured inactivity limit are selected.
**Default settings**
| Setting | Default | Allowed range |
| -------------------- | ------- | ------------- |
| Dormant after (days) | `90` | 1–365 |
Client overrides can change these values. [Check the effective settings](/controls/parameters) when interpreting a result.
**What the result tells you**
Review the selected account population and its business purpose before acting. An automated disabled-state expectation does not authorise disabling an account.
| Setting | Value |
| ----------------- | ------------------------ |
| Standard | Alignr Baseline (seeded) |
| Severity | High |
| Declared autonomy | Change ticket |
**Population condition**
**Account enabled** (`account_enabled`) has an observation.
* Filter: **Last interactive sign-in** (`last_sign_in`) is more than this many days in the past: parameter `dormant_days`.
**Expected evidence**
* **Account enabled** (`account_enabled`) equals `false`.
**Required predicates:** `account_enabled`, `last_sign_in`.
```json theme={null}
{
"match": {
"predicate": "account_enabled"
},
"where": [
{
"fact": "last_sign_in",
"op": "older_than_days",
"value": {
"param": "dormant_days"
}
}
],
"expect": [
{
"fact": "account_enabled",
"op": "eq",
"value": false
}
],
"severity": "high",
"title": "Dormant account is still enabled",
"evidence": [
"account_enabled",
"last_sign_in"
]
}
```
Each selected policy should be enabled.
Part of **Alignr Baseline (seeded)**.
**Applies to**
Conditional Access policies observed with an All users scope.
**What the result tells you**
The title is broader than the measured condition: an observed All users policy being enabled does not establish all policy interactions, exclusions or sign-in enforcement.
| Setting | Value |
| ----------------- | ------------------------ |
| Standard | Alignr Baseline (seeded) |
| Severity | Medium |
| Declared autonomy | Suggest only |
**Population condition**
**Policy scope** (`ca_policy_scope`) equals `"All users"`.
**Expected evidence**
* **Policy state** (`ca_policy_state`) equals `"enabled"`.
**Required predicates:** `ca_policy_scope`, `ca_policy_state`.
```json theme={null}
{
"match": {
"predicate": "ca_policy_scope",
"object": "All users"
},
"expect": [
{
"fact": "ca_policy_state",
"op": "eq",
"value": "enabled"
}
],
"severity": "medium",
"title": "Tenant-wide conditional access policy is not enforced",
"evidence": [
"ca_policy_scope",
"ca_policy_state"
]
}
```
MFA bypass should be off for each selected account.
Part of **Alignr Baseline (seeded)**.
**Applies to**
Subjects with a recorded mfa bypass enabled observation.
**What the result tells you**
A registered factor and an active bypass can coexist. Review approved emergency access and any temporary exception before changing the account.
| Setting | Value |
| ----------------- | ------------------------ |
| Standard | Alignr Baseline (seeded) |
| Severity | High |
| Declared autonomy | One click |
**Population condition**
**MFA bypass enabled** (`mfa_bypass_enabled`) has an observation.
**Expected evidence**
* **MFA bypass enabled** (`mfa_bypass_enabled`) equals `false`.
**Required predicates:** `mfa_bypass_enabled`.
```json theme={null}
{
"match": {
"predicate": "mfa_bypass_enabled"
},
"expect": [
{
"fact": "mfa_bypass_enabled",
"op": "eq",
"value": false
}
],
"severity": "high",
"title": "Account has an active MFA bypass",
"evidence": [
"mfa_bypass_enabled"
]
}
```
Each selected account should have MFA registered.
Part of **BIOS Identity Assurance**.
**Applies to**
Accounts observed as enabled.
**What the result tells you**
This checks MFA registration, not effective enforcement at every sign-in. Review policy coverage, allowed methods and emergency exclusions separately.
| Setting | Value |
| ----------------- | ----------------------- |
| Standard | BIOS Identity Assurance |
| Severity | High |
| Declared autonomy | Suggest only |
**Population condition**
**Account enabled** (`account_enabled`) equals `true`.
**Expected evidence**
* **MFA registered** (`mfa_registered`) equals `true`.
**Required predicates:** `account_enabled`, `mfa_registered`.
```json theme={null}
{
"match": {
"predicate": "account_enabled",
"object": true
},
"expect": [
{
"fact": "mfa_registered",
"op": "eq",
"value": true
}
],
"severity": "high",
"title": "Active account lacks MFA",
"evidence": [
"account_enabled",
"mfa_registered"
]
}
```
Each selected account should have MFA registered.
Part of **BIOS Identity Assurance**.
**Applies to**
Accounts observed with the Global Administrator role.
**What the result tells you**
This checks MFA registration, not effective enforcement at every sign-in. Review policy coverage, allowed methods and emergency exclusions separately.
| Setting | Value |
| ----------------- | ----------------------- |
| Standard | BIOS Identity Assurance |
| Severity | High |
| Declared autonomy | Suggest only |
**Population condition**
**Directory role** (`has_role`) equals `"Global Administrator"`.
**Expected evidence**
* **MFA registered** (`mfa_registered`) equals `true`.
**Required predicates:** `has_role`, `mfa_registered`.
```json theme={null}
{
"match": {
"predicate": "has_role",
"object": "Global Administrator"
},
"expect": [
{
"fact": "mfa_registered",
"op": "eq",
"value": true
}
],
"severity": "high",
"title": "Global Administrator lacks MFA",
"evidence": [
"has_role",
"mfa_registered"
]
}
```
## Manual checks
These are human reviews, not automated evidence. The interval below is the template default; review ownership, evidence and suitability for the client.
**Review every 90 days** · BIOS Identity Assurance
Verify the intended account population is covered by enabled policies, required grant controls and approved emergency exclusions. Review policy interactions and test sign-in enforcement. Registration or an enabled policy alone does not prove MFA enforcement.
**Record:** who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.
**Review every 90 days** · BIOS Identity Assurance
Confirm named emergency accounts, exclusions, monitoring and last access test against the approved policy.
**Record:** who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.
**Review every 90 days** · BIOS Identity Assurance
Review consent policy, verified publishers, privileged grants and documented exceptions.
**Record:** who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.
## Investigate a result
Confirm the client and the account, device or other item being assessed. Check the source, observation time and effective settings, then compare the recorded evidence with the expectation. Missing evidence needs investigation; a change to the environment requires a separate review.
## Next steps
[Create a custom control](/controls/create-custom) · [Parameters and client overrides](/controls/parameters) · [Record a manual check](/controls/manual-checks)