IA.2.078 — Use multifactor authentication for local and network access

What IA.2.078 means in plain English

A password alone is not enough anymore — attackers can steal passwords. MFA adds a second check (like a code on your phone) so even if your password is stolen, the attacker still cannot get in. For your team: every person must use MFA to log into Microsoft 365 email, and any admin account must use MFA even for local Windows logins. Microsoft Authenticator is free, takes 10 minutes to set up per person, and is the single highest-return security investment you can make. This one control blocks over 99% of automated credential-stuffing attacks.

The assessment question

“Is MFA enforced on all privileged accounts for both local and network access, AND on all non-privileged accounts for network access — with no exemptions or bypass methods in place?”

How to implement IA.2.078

1. Enable Azure AD MFA for all users in Microsoft 365 Admin Center: go to Azure Active Directory > Security > MFA and enable per-user MFA or use Conditional Access (included in Microsoft 365 Business Premium).
2. Deploy Microsoft Authenticator app on every employee smartphone — walk each person through enrollment in a 15-minute setup session.
3. Create a Conditional Access policy (Business Premium) or enforce Security Defaults (free) that blocks any login without MFA regardless of location.
4. For privileged/admin accounts, enforce MFA via Windows Hello for Business or require FIDO2 security keys for local machine access.
5. Document MFA enrollment for each user and test a simulated login from outside the office to confirm MFA challenge fires.

Evidence your assessor will ask for

• Azure AD MFA status report showing 100% of users enrolled
• Conditional Access policy screenshot showing MFA required for all apps
• Authentication log showing MFA challenges being triggered on logins
• Signed user enrollment records confirming each employee completed MFA setup

More Identification & Authentication controls