Multifactor Authentication

Network access includes your office LAN. Get the definitions right before you scope anything.

The assessment guide defines local access as access obtained by direct connection without the use of networks, and network access as access obtained through network connections. A user signing into a domain workstation at a desk is network access. MFA (multifactor authentication) on the VPN and on Microsoft 365 while plain passwords open everything on the internal network is the classic failure of objective [d].

Objective [a] is a list you write before touching any technology.

Identify every privileged account: domain and Microsoft Entra ID administrator roles, firewall and switch administration, hypervisor and backup consoles, and your managed service provider's accounts in your environment. Privileged accounts then need MFA everywhere, including local access under [b]. Non-privileged accounts need it for network access under [d].

Factors are something you know, have, or are. Device attributes are not factors.

A compliant device, an allowed IP range, a MAC address, or a location is a policy condition, not a second factor. An authenticator app, a FIDO2 key, a smart card, or a time-based code is. Conditional Access policies in Microsoft Entra ID enforce MFA. They are not themselves MFA.

Password fallback quietly deletes your MFA.

Windows Hello for Business with a TPM (the trusted platform module chip) plus PIN or biometric is a defensible two-factor implementation, but only when enforced. If a user can pick other sign-in options and get in with just the password, the control is optional, and demonstrating your sign-in flow is a standard assessment step. Enforce the strong path and be ready to show both factors in use.

Local access to privileged accounts is the objective people forget.

Objective [b] covers the administrator at the console. An OS-level MFA agent on servers and admin workstations covers it directly. Vaulted credentials cover it another way. When the local administrator password sits in LAPS, Microsoft's Local Administrator Password Solution, or in a privileged access vault that itself demands MFA, retrieving the credential requires the second factor.

Phones do not need MFA to unlock. They need it to reach your systems.

The assessment guide states that multifactor authentication is not required for access to mobile devices such as smartphones or tablets. The session the phone opens to your email or files is network access to your system and prompts like any other client.

The scoring rule gives partial credit here and removes the deferral path.

32 CFR 170.24 subtracts three points when MFA covers only remote and privileged users, and five when it covers no one. This is one of only two Level 2 requirements scored with partial credit. A plan of action and milestones is the documented list of gaps you commit to close after assessment. Because the value exceeds one point either way, 32 CFR 170.21 keeps IA.L2-3.5.3 off a Conditional status plan. Finish it before assessment.