MFA for everyone, except the admins?
May 15th, 2024 by Jesper Kråkhede
I have stopped counting the organisations I meet that have rolled out MFA to all users, but not to the admins. It sounds absurd, but there are reasons.
In the cloud, many organisations have MFA for normal users through Conditional Access, but exclude service accounts, break glass accounts and, quite often, a number of admins who complained or who use tools that don´t support it. The exclusion list grows and nobody reviews it.
On-premises, it is even worse. In Active Directory, the Domain Admins almost never use MFA. They log on with a username and password, often over remote desktop, to domain controllers and servers. Smart cards were once the answer, but very few organisations use them today. So the accounts with the most power in the whole company are protected by the weakest method.
The attackers know this. Phishing a normal user gives them a foothold. But to own the company they need an admin. And if the admin account only has a password, a stolen hash or a phished password is enough.
What to do? Start with the admins, not the end users. In the cloud, require phishing resistant MFA for every admin role, and review every exclusion. On-premises, protect the Domain Admins with smart cards or Windows Hello for Business, put them in Protected Users and only let them log on from PAWs. Use MFA for remote desktop and remote PowerShell to Tier 0.
The strongest protection belongs on the strongest accounts. Not the other way around.