Forum Discussion

Gunter Danzeisen's avatar
Gunter Danzeisen
Brass Contributor
Sep 04, 2019

Question on: MFA should be enabled on accounts with owner permissions on your subscription

Hi Everyone, we have an Azure emergency account that is not enabled for MFA and therefor this user shows up on the "MFA should be enabled on accounts with owner permissions on your subscription" Warning. Is there a way to exclude just a single user from this policy or do I have to disable this security completely?

Regards,

Gunter

  • Hello Gunter Danzeisen 

    you cannot exclude the account from the policy. 

    On the other hand, I always suggest other ways to bypass the MFA.

    one way is to create a trusted location in conditional access or just add the trusted IPs at the Office 365 MFA page. Then create a rule for this account to exclude MFA on trusted locations.

    An other way is to create a "back door" account, as Dr Nestori suggests : http://o365blog.com/post/aadbackdoor/

  • Hello Gunter Danzeisen 

    you cannot exclude the account from the policy. 

    On the other hand, I always suggest other ways to bypass the MFA.

    one way is to create a trusted location in conditional access or just add the trusted IPs at the Office 365 MFA page. Then create a rule for this account to exclude MFA on trusted locations.

    An other way is to create a "back door" account, as Dr Nestori suggests : http://o365blog.com/post/aadbackdoor/

    • gsreejith's avatar
      gsreejith
      Copper Contributor

      papostolidis

       

      I have a similar issue, but in my case I have enabled the third party MFA -DUO in my Azure subscription. But still it shows "MFA should be enabled on accounts with owner permissions on your subscription".

       

      Is there any method to bypass or any settings available in the azure portal.

       

      Thanks

      Sreejith.G

      • pazdedav's avatar
        pazdedav
        Steel Contributor

        Hi gsreejith 

         

        If your question is: "How can I tune ASC to stop showing recommendations I deem as false positive?", then there is a way how you can edit ASC security policy and turn off specific parts (e.g. MFA for owners), so you won't see related recommendations in the Compliance center anymore.

  • surajgangwar's avatar
    surajgangwar
    Copper Contributor
    Hello,

    We are also using third party IAM soution. I am also facing the same issue. My question is can the security center fetch data from IAM(okta, etc.) solution and show the IAM security recommendations based on that data? If yes, how can we achieve it.

Resources