MFA for cloud services

Requirements v3.3 says authentication to cloud services must always use multi-factor authentication (MFA). That means every user and admin account on every cloud service you use for business, wherever the service offers MFA. Under the Danzell question set, IASME has confirmed that a cloud service with MFA available but not enabled is an automatic fail (questions A7.14 to A7.17).

What MFA is

MFA checks identity using two or more separate factors, such as something you know (a password) and something you have (a phone or security key). A stolen password on its own is then not enough to get in.

Version 3.3 describes four kinds of additional factor:

• a managed or enterprise device,
• an app on a trusted device, such as an authenticator app or push prompt,
• a physically separate token, such as a security key, and
• a known or trusted account.

SMS codes are allowed. The NCSC says they are not the most secure option but are far better than no MFA, and recommends other methods where they work for you.

Passkeys and FIDO2 count. Version 3.3 treats FIDO2 authenticators as passkeys and regards them as MFA. See passwords and passkeys.

Trusted locations do not count. IASME's guidance is that allowing sign-in without a second factor because the user is on a trusted IP address, or a conditional access rule based on location, is not MFA.

The password part of MFA

Where one of the factors is a password, that password must be at least 8 characters, with no maximum length.

What "available" means

IASME's guidance is strict. If a service offers MFA in any form, it counts as available. That includes MFA that:

• is free or bundled with your plan,
• comes through signing in with another account, such as "Sign in with Microsoft" or Google, where that account has MFA, or
• needs a paid upgrade or add-on.

If a service genuinely offers no MFA at all, you list it in the assessment. Assessors check these claims, so be sure before you say so. IASME keeps a list of whether common cloud services offer MFA, while noting it cannot be complete.

Beyond cloud services

Version 3.3 also says you should always use MFA for admin accounts and for accounts reachable from the internet, such as VPNs, webmail and remote desktop gateways.

Common problems

• MFA is on for staff but not for the admin or break-glass account.
• A small service, such as a domain registrar, accounting app or social media account used for business, was never checked.
• Some users were never enrolled, or MFA is "enabled" but not enforced.
• Legacy sign-in methods that skip MFA, such as old email protocols, are still allowed.
• An account was left off MFA because the user does not have a work phone. A security key or desktop authenticator solves this.

What to do

1. List every cloud service used for business, including free tools signed up to with a work email.
2. For each one, check whether MFA is offered in any form. Check the vendor's help pages if unsure.
3. Turn MFA on and enforce it for every account, including admin and emergency access accounts.
4. Block legacy sign-in methods that bypass MFA where the service allows.
5. Prefer authenticator apps, passkeys or security keys over SMS.
6. Record any service with no MFA and the evidence you checked.

Any other non-compliant answer on a requirement fails the assessment too. See automatic-fail questions. The readiness checker asks about MFA for each type of cloud service you use.