MFA Operations

Purpose: MFA enrollment, reset, exception handling, and break-glass procedures across all identity providers.

Owner: Rory Audience: Rory, Kevin (break-glass approvals)

---

Identity Providers in Scope

Provider	Who Uses It	MFA Enforced Via
Entra ID PROD (ciriusgroup.com)	All employees	Conditional Access
Entra ID DDE (ciriusdde.com)	DDE environment users	Conditional Access
OneLogin	Contractors and vendors	OneLogin MFA policy
AWS IAM Identity Center	All AWS console users	IAM Identity Center MFA settings

---

MFA Methods by Tier

Tier	Users	Method	Why
Tier 1 — Standard	All users	Microsoft Authenticator (push)	Phishing-resistant push with number matching enabled
Tier 2 — Privileged	Rory + any PIM Global Admin activators	FIDO2 hardware key (YubiKey)	Required for PIM activation of Global Admin, Privileged Role Admin
Tier 3 — Break-glass	Break-glass accounts	TOTP via Keeper	Works without network access to push notification service

---

New Employee — MFA Enrollment

1. Create the user in Entra: Entra → Users → New user
2. Rory assigns the Microsoft Authenticator:
   • Entra → Users → [new user] → Authentication methods → Add authentication method → Microsoft Authenticator
3. User receives a welcome email with the MFA setup link (Entra generates this automatically on first sign-in)
4. User installs Microsoft Authenticator on their phone and registers
5. Verify enrollment: Entra → Users → [user] → Authentication methods — confirm Microsoft Authenticator appears as a registered method
6. Do not mark onboarding complete until MFA is confirmed working. See runbooks/employee-onboarding.md

---

FIDO2 Hardware Key — Enrollment

Required for Rory and any account that activates Global Admin or Privileged Role Admin via PIM.

1. Assign a YubiKey from the hardware key inventory (tracked in Keeper → Hardware → YubiKey Inventory)
2. User registers the key:
   • Entra → My Security Info → Add sign-in method → Security key
   • Tap the key when prompted, set a PIN
3. Document the key serial number against the user in Keeper
4. Test: user must successfully authenticate with FIDO2 before any other change is made to their account
5. If the key is lost: revoke the key's registration in Entra → Authentication methods → delete FIDO2 credential. Issue a replacement key and re-enroll

---

MFA Reset — User Locked Out

When a user cannot sign in due to MFA issues (lost phone, new device, corrupted app):

1. Rory (or Kevin/Greg with admin) → Entra → Users → [user] → Authentication methods
2. Delete all registered MFA methods
3. User registers new MFA on their new device via the next sign-in prompt
4. Document the reset in SecOps: informational incident, category=identity-management, description "MFA reset for [user] due to [reason]"
5. If the reset is due to a lost or stolen device: also revoke all active sessions:
   • Entra → Users → [user] → Revoke sessions
   • Check if the lost device had any active refresh tokens that need rotation

---

Bulk MFA Review

Quarterly as part of the monthly security review (runbooks/monthly-security-review.md):

// Accounts with no MFA registered
let mfa_registered = SignInLogs
    | where TimeGenerated > ago(30d)
    | where AuthenticationDetails has "MFA"
    | distinct UserPrincipalName;
SignInLogs
| where TimeGenerated > ago(30d)
| distinct UserPrincipalName
| where UserPrincipalName !in (mfa_registered)

Any active user account with no MFA: Rory contacts the user within 48 hours to complete enrollment.

---

Conditional Access — MFA Enforcement

Entra Conditional Access requires MFA for all cloud apps. Any sign-in without MFA is blocked. Details in runbooks/conditional-access-reference.md.

Conditional Access policies in PROD:

• Require MFA for all users, all apps — baseline policy
• Require FIDO2 for privileged roles — applied when PIM is activated for Global Admin / Privileged Role Admin

No MFA exceptions are permitted for accounts with access to ePHI systems.

---

AWS IAM Identity Center MFA

1. Sign into IAM Identity Center portal as Rory
2. Settings → Multi-factor authentication → Context-aware MFA: Always on
3. Users who have not registered MFA in IAM Identity Center: they are blocked from accessing the AWS console
4. User MFA enrollment: user visits the IAM Identity Center portal → My account → MFA devices → Register device (Authenticator app)

Confirm MFA is enforced:

aws sso-admin describe-permission-set --instance-arn <instance-arn> --permission-set-arn <arn>
# Verify SessionDuration and that MFA is not bypassed

---

OneLogin MFA — Contractors and Vendors

Contractor MFA is managed via OneLogin policy (runbooks/onelogin-operations.md).

• Policy: MFA required at login and when accessing any app tagged as sensitive
• Accepted methods: TOTP (Google Authenticator, Authy), OneLogin Protect app
• Enrollment: triggered automatically on first login

For contractor offboarding: deactivate the OneLogin account before removing other access. This ensures the contractor's MFA device is also immediately invalidated.

---

Break-Glass MFA

Break-glass accounts use TOTP (not push notifications) to ensure they work even when:

• The Authenticator app service is unreachable
• The registered phone is unavailable

TOTP seeds for all break-glass accounts are stored in Keeper. Rory and Kevin both have access to the break-glass section of Keeper for emergency use.

Break-glass TOTP is tested quarterly as part of runbooks/annual-bgkit-verification.md. If a test fails, Rory re-registers the TOTP seed immediately.

---

MFA Exceptions

There are no MFA exceptions for any account that can access ePHI systems.

Service accounts and managed identities are not subject to MFA (they use certificates, managed identity tokens, or API keys) and are not counted as MFA exceptions. Their access is reviewed separately in runbooks/quarterly-sp-permission-review.md.

---

Related Documents

• runbooks/conditional-access-reference.md — CA policies enforcing MFA
• compliance/pim-operations.md — PIM activation and FIDO2 requirements
• runbooks/annual-bgkit-verification.md — break-glass MFA testing
• runbooks/employee-onboarding.md — new employee MFA enrollment
• runbooks/onelogin-operations.md — contractor MFA via OneLogin