Incomplete MFA Rollout Leaves Accounts Unprotected: PowerShell + Graph Script Highlights Gaps
What Happened — A SANS Internet Storm Center diary entry shares a PowerShell/Graph/Entra script that enumerates Azure AD accounts that were missed during a multi‑factor authentication (MFA) rollout. The author notes that manual checks are impractical at scale and that the script surfaces “orphaned” accounts still relying on only passwords.
Why It Matters for Compliance & Audit Readiness
- Un‑mfa‑protected identities constitute a control weakness against the SOC 2 CC6.1 (Logical Access) and CC6.2 (System Operations) criteria.
- Continuous evidence that all privileged and high‑risk accounts have MFA enabled is a core audit artifact; gaps undermine the defensible audit trail.
- The scenario maps directly to Verisq’s SOC2 Access Controls capability, which automates MFA compliance monitoring and provides ready‑to‑use evidence for auditors.
Who Is Affected — Enterprises of any size that manage Azure AD/Entra ID, especially SaaS providers, financial services, and healthcare organizations that rely on Microsoft identity platforms.
Recommended Actions
- Run the published script (or an equivalent inventory tool) to generate a definitive list of accounts lacking MFA.
- Map the findings to your SOC 2 access‑control matrix; create remediation tickets for each orphaned account.
- Enable continuous monitoring of MFA status via an automated compliance platform and retain the logs as audit evidence.
Source: SANS ISC Diary – MFA Rollout Script
Technical Notes — The script leverages the Microsoft.Graph.Beta PowerShell module to query Entra ID user objects and filter on the mfaMethods property. No vulnerability or CVE is disclosed; the risk is operational – accounts that remain single‑factor are susceptible to credential‑theft attacks. Source: same as above