Identity and SSO

Checks whether an Okta org has an active MFA enrollment policy that requires at least one authentication factor. Calls GET https://{oktaDomain}/api/v1/policies?type=MFA_ENROLL, authenticated with an Authorization: SSWS {apiToken} header, Okta's own token scheme.

oktaDomain

the org's Okta domain, also used as the check target.

apiToken

an Okta API token with permission to read policies.

Covers classic-engine MFA_ENROLL policies only. An Okta Identity Engine org enforces MFA through a different policy type this check does not read, and reports as needs-review rather than a false fail. A 401 or 403 response is also reported as needs-review, never fail, since a rejected token proves nothing about the policy itself.

Checks whether an Azure AD (Microsoft Entra ID) tenant has at least one enabled Conditional Access policy whose grant controls include the built-in mfa control. Calls GET https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies with a Microsoft Graph bearer token.

tenantId

the tenant identifier, used as the target label. The token itself scopes the request to one tenant.

accessToken

a Microsoft Graph bearer token with at least Policy.Read.All.

Covers Conditional Access only, Microsoft's current recommended mechanism. Legacy per-user MFA settings are not read. Reads the first page of results only. A 401 or 403 response is reported as needs-review, never fail.

Checks whether every active user in a Google Workspace domain has 2-Step Verification enforced by org policy, reading the Admin SDK Directory API's isEnforcedIn2Sv field, not the separate is2SvEnrolled field a user could turn on voluntarily. Paginates through every user with nextPageToken, using an OAuth2 bearer token scoped to admin.directory.user.readonly or broader.

accessToken

an OAuth2 bearer token for the Admin SDK Directory API.

customerId (optional)

defaults to my_customer, Google's alias for the calling admin's own domain.

Suspended users are excluded from the pass and fail determination. A 401 or 403 response is reported as needs-review, never fail.

The same check as google-workspace-2fa-enforced, run against a Google Cloud organization's Cloud Identity directory instead of a Google Workspace domain. Cloud Identity users are managed through the same Admin SDK Directory API and the same isEnforcedIn2Sv field, kept as its own check so a GCP integration can be configured and audited independently of a Google Workspace integration on the same organization.

accessToken

an OAuth2 bearer token for the Admin SDK Directory API.

customerId (optional)

defaults to my_customer.

Suspended users are excluded. Paginates through every user. A 401 or 403 response is reported as needs-review, never fail.

Checks whether at least one MFA (Guardian) factor is enabled for an Auth0 tenant. Calls GET https://{tenantDomain}/api/v2/guardian/factors, authenticated with a Machine-to-Machine bearer access token scoped to read:guardian_factors.

tenantDomain

the Auth0 tenant domain, also used as the target.

accessToken

an already-obtained Auth0 Management API M2M access token.

A pass means at least one factor is turned on tenant-wide. It does not mean every user is forced through MFA on every login, since that is controlled by tenant policy the Management API does not expose as a single field. A 401 or 403 response is reported as needs-review, never fail.

Checks whether every active Duo Security user has at least one MFA method (a phone or hardware token) enrolled. Calls Duo's Admin API at GET https://{apiHostname}/admin/v1/users, paginated, authenticated with Duo's Auth API v5 request-signing scheme: an HMAC-SHA512 signature computed over the request from the integration key and secret key, not a bearer token.

apiHostname

the Duo API hostname, also used as the target.

integrationKey, secretKey

the Duo Admin API credential pair used to sign each request.

A 401 or 403 response is reported as needs-review, never fail.

Checks whether every active OneLogin user has at least one MFA device enrolled. First exchanges a client ID and secret for a short-lived bearer token at POST https://{subdomain}.onelogin.com/auth/oauth2/v2/token (HTTP Basic auth, client-credentials grant), then paginates GET /api/2/users and reads each active user's devices from GET /api/2/mfa/users/{id}/devices.

subdomain

the OneLogin subdomain. The target is {subdomain}.onelogin.com.

clientId, clientSecret

a OneLogin API credential pair used to generate the bearer token.

Only users with OneLogin's active status are checked. Suspended, locked, and pending accounts are excluded. A 401 or 403 response is reported as needs-review, never fail.

Checks whether at least one active JumpCloud policy enforces multi-factor authentication. Calls the JumpCloud Admin API v2 policies endpoint, authenticated with an x-api-key header rather than a bearer token, and looks for an active policy whose template name matches an MFA-shaped pattern.

apiKey

a JumpCloud Admin API key. The target is a fixed label, since the key itself scopes the request to one org.

JumpCloud names its MFA policy templates differently across plans and versions, so the match is a pattern rather than one exact template name. A 401 or 403 response is reported as needs-review, never fail.