PCI DSS v4.0/Requirement 08: Identify Users and Authenticate Access to System Components/132 of 250
8.4.1Multi-factor authentication (MFA) is implemented to secure access into the CDE
Control family: Requirement 08: Identify Users and Authenticate Access to System Components
Control description
Defined Approach Requirements:
MFA is implemented for all non-console access into the CDE for personnel with administrative access.
Defined Approach Testing Procedures:
8.4.1.a Examine network and/or system configurations to verify MFA is required for all non-console into the CDE for personnel with administrative access.
8.4.1.b Observe administrator personnel logging into the CDE and verify that MFA is required.
How to implement
Coming in phase 2Step-by-step guidance for implementing this control on Microsoft Azure, using services such as Azure Policy, Microsoft Defender for Cloud and Entra ID. It will be matched to your environment.