Set Up MFA for Critical Platforms
Learn how to set up and enforce MFA across AWS, GitHub, Bitbucket, Okta, Office365, and Google Workspace, and resolve failing Sprinto monitors.
Multi-Factor Authentication (MFA) is a critical control to secure user accounts across cloud and identity providers. Sprinto automatically monitors MFA status across integrated services and raises alerts if MFA is not enabled for specific users or accounts.
This guide covers how to enable MFA for key platforms and resolve failing monitors in Sprinto.
Platforms Covered
AWS (Root and IAM users)
GitHub (User and Org-level)
Bitbucket
Okta
Office365 (Microsoft Entra ID)
Google Workspace
How Sprinto Monitors MFA
For each connected service, Sprinto evaluates whether MFA is:
Enforced at the user or organisation level
Enabled for privileged accounts (e.g., root users, administrators)
Automatically verifiable via integration or requires evidence upload
Sprinto raises a Failing status if MFA is not detected for one or more users, along with guidance to fix the issue.
MFA Setup Instructions
Given below are the setup instructions for all the Platforms.
1. AWS
Root User MFA
Sign in to the AWS Console using the root account.
Navigate to My Security Credentials.
In the Multi-Factor Authentication (MFA) section, choose Activate MFA.
Select Virtual MFA device, and follow the QR code and OTP setup.
Confirm and save.
IAM User MFA
Go to IAM > Users.
Select a user → Security credentials tab.
Under Assigned MFA device, choose Manage.
Configure virtual or hardware MFA.
2. GitHub
User-Level
Go to Settings > Password and authentication.
Enable Two-factor authentication.
Set up via TOTP app or SMS.
Org-Level
Navigate to Org Settings > Security > Authentication security.
Enable the setting: Require two-factor authentication for all members.
Confirm changes.
3. Bitbucket
Log in to Bitbucket.
Go to Personal settings > Security.
Enable Two-step verification.
Scan QR code using an authenticator app and verify with OTP.
4. Okta
Navigate to Security > Multifactor > Factor Enrollment.
Select factors (e.g., Okta Verify, TOTP, SMS) and set them as Required.
Under Security > Authentication Policies, ensure policies require MFA at login.
Save changes.
5. Office365 (Microsoft Entra ID)
Sign in to https://entra.microsoft.com/ (Azure Active Directory portal).
Go to Users > Per-user MFA.
Select users and click Enable.
Optionally, use Conditional Access to enforce MFA for groups or roles.
6. Google Workspace
Go to Admin Console > Security > Authentication > 2-step verification.
Set Allow users to turn on 2-step verification.
Select Enforce for specific organisational units or groups.
Save configuration.
Resolving Sprinto Monitor
Once MFA is configured, Sprinto will automatically re-check during the next sync.
For platforms without API-based verification (e.g., Bitbucket), upload evidence (screenshots, policy docs).
Use the Mark as resolved action after applying fixes manually.
Best Practices
Enforce MFA for all users, not just admins.
Periodically audit MFA enforcement at the organisation level.
Prefer app-based MFA (e.g., TOTP) over SMS-based methods.
Use Conditional Access or group policies to automate enforcement.
Last updated