Disable Account MFA

Description

disable account mfa module attempts to disable tenant level MFA on a target account in Entra ID.

Trigger

MAAD Attack Arsenal -> "Account" -> 7

MITRE ATT&CK Information

Tactic	Technique
Persistence	Modify Authentication Process: Multi-Factor Authentication
Defense Evasion	Modify Authentication Process: Multi-Factor Authentication
Credential Access	Modify Authentication Process: Multi-Factor Authentication

Additional Details

Microsoft services being accessed by this module:

• Entra ID (Azure AD)

External PowerShell module used:

• AzureAd