OCI IAM Console Users Should Have MFA Enforced

​

1. Identify the Identity Domain Used for Console Logins

1. Sign in to the OCI Console as a tenancy admin.
2. Open the navigation menu → Identity & Security → Identity Domains.
3. Locate the identity domain(s) where your console users exist (often named Default, or similar).
4. Click the target identity domain name to manage its settings.

​

2. Configure MFA Factors in the Identity Domain

1. Inside the identity domain, go to Security → Multi-Factor Authentication (or Security → Factors, depending on version).
2. Under Available Factors, ensure at least one of these is Enabled:
   • Time-based One-Time Password (TOTP) (e.g., Google Authenticator, Microsoft Authenticator)
   • Email OTP or SMS OTP (if allowed by your policy)
3. Save any changes.

​

3. Enforce MFA via Sign-On Policy

1. In the same identity domain, go to Security → Sign-on Policies.
2. Either edit the existing default sign-on policy or create a new policy:
   • Click Create Sign-on Policy (if creating new).
   • Name it (e.g., Require-MFA-For-Console).
3. Add a Rule (or edit an existing rule) that matches all interactive console users, for example:
   • Conditions:
     • Client Type: Browser (or All if you want broad coverage).
     • IP Range / Network Perimeter: as required (or leave broad for all).
     • User Group: choose groups that represent console users (e.g., Administrators, OCI-Console-Users) or All users if every human user must have MFA.
   • Actions / Access:
     • Set Require multi-factor authentication = Yes (or choose the specific factor set if prompted).
4. Ensure rule order is correct:
   • Rules are evaluated top-down. Place the MFA-required rule above any rules that might allow access without MFA.
5. Save the sign-on policy and make sure it is Active.

​

4. Require Existing Users to Register MFA

1. In the identity domain, go to Users.
2. Pick a user → check Security / Multifactor Authentication or Factors tab:
   • Confirm if they already have an enrolled factor (e.g., TOTP).
3. If not enrolled:
   • Tell users to sign in to the OCI Console.
   • On next sign-in, due to the new sign-on policy, they’ll be guided to register MFA (e.g., scan QR code with an authenticator app).
4. For critical/admin users, you can test:
   • Log in as that user (or with a test user in same groups) to verify you’re forced to set up MFA and use it.

​

5. Confirm with OCI IAM Monitoring / Cloud Guard

1. Go to Identity & Security → Cloud Guard.
2. Under Detected Problems (or Targets → Problems):
   • Filter by resource type IAM, or by the specific problem name (e.g., OCI IAM Console Users Should Have MFA Enforced).
3. After the new sign-on policy has been active and users start registering MFA, let Cloud Guard re-evaluate (or manually Recalculate / Re-evaluate if available).
4. Confirm the problem status moves to Resolved or No problems for IAM console MFA.

​

6. Optional: Tighten for Admin / Privileged Groups

1. Create a separate sign-on policy specifically targeting:
   • Admin groups: Administrators, SecurityAdmins, NetworkAdmins, etc.
2. For these rules:
   • Always require MFA (no exceptions by IP or network).
3. Place these rules at the top in the sign-on policy order.

• Enable at least one MFA factor in the identity domain.
• Create or edit a Sign-On Policy to require MFA for console access for all (or all human) IAM users.
• Ensure rule ordering enforces MFA, and confirm via user login test.
• Verify in Cloud Guard / IAM Monitoring that the “MFA enforced” check is now passing.

​

1. Prerequisites

• OCI CLI installed and configured with a tenancy‑admin or security‑admin–level profile:

oci setup config

• Know your:
  • Tenancy OCID: ocid1.tenancy.oc1....
  • Home region (for IAM operations): e.g. us-phoenix-1

export OCI_CLI_REGION=us-phoenix-1
export OCI_CLI_PROFILE=DEFAULT

​

2. List all IAM users and check MFA status

​

2.1 Get all users (classic IAM)

oci iam user list \
  --all \
  --query "data[].{name:\"name\", ocid:\"id\", mfa:\"is-mfa-activated\"}" \
  --output table

oci iam user list \
  --all \
  --query "data[?\"is-mfa-activated\"==\`false\`].{name:\"name\", ocid:\"id\"}" \
  --output table

oci identity-domains user list \
  --identity-domain-id <identity_domain_ocid> \
  --all

​

3. Create a monitoring script

#!/usr/bin/env bash
set -euo pipefail

NON_MFA_USERS=$(oci iam user list --all \
  --query "data[?\"is-mfa-activated\"==\`false\`].name" \
  --raw-output)

if [ -n "$NON_MFA_USERS" ]; then
  echo "Users without MFA:"
  echo "$NON_MFA_USERS"
  exit 1   # mark as non-compliant
else
  echo "All users have MFA enabled."
fi

​

4. Enforce MFA (remediation)

1. Enforcing MFA via Identity Domain sign‑on policies (Console):
   • Go to: Identity & Security → Domains → select your domain.
   • Security → Sign-on policies.
   • Edit or create a policy that requires MFA for:
     • “OCI Console access” (or equivalent app),
     • All users or targeted groups.
   • Set conditions (e.g., all networks) and require at least one MFA factor.
2. Communicating to users:
   • Notify the non‑MFA users identified by the script to log in and complete MFA enrollment.
   • Optionally, set a deadline and then:
     • Disable users who haven’t enrolled MFA:
       oci iam user update \
         --user-id <user_ocid> \
         --force --defined-tags '{}' \
         --freeform-tags '{}' \
         --lifecycle-state INACTIVE
       
       (Use carefully; you’re disabling the account.)

​

5. Optional: Wire into OCI Cloud Guard / Security Zones

• Enable Cloud Guard with a detector recipe that includes the “MFA not enabled for IAM users” rule (if present for your tenancy).
• You can then use responder recipes, or a Function triggered by events, to:
  • Run the CLI monitoring script,
  • Create incidents or send notifications for non‑MFA users.

• Use OCI CLI to monitor MFA status and detect non‑compliant console users.
• Use Identity Domain sign‑on policies (via Console or IAM APIs if/when available) to enforce MFA globally.
• Users must self‑register MFA; you can optionally disable non-compliant accounts via CLI as a hard remediation step.

Note: MFA is enforced via IAM security policies / identity domain authentication policies, not user-by-user. What you can do with Python is:

• Detect users without MFA
• Push that info into logs/metrics, send notifications, or use it as an input for governance.

​

1. Prerequisites

1. Install OCI Python SDK:

pip install oci

2. Configure your OCI credentials (one of):
   • ~/.oci/config (via oci setup config), or
   • Instance principal / resource principal if running on OCI compute / functions.

[DEFAULT]
user=ocid1.user.oc1..aaaa...
fingerprint=xx:xx:xx:...
key_file=/path/to/private_key.pem
tenancy=ocid1.tenancy.oc1..aaaa...
region=us-ashburn-1

​

2. Python Script: List Users Without MFA

• Lists all users in your tenancy
• For each user, checks if any TOTP MFA devices exist
• Prints and optionally sends them to Monitoring or Notifications

import oci
from oci.config import from_file

def get_identity_client(config_profile="DEFAULT"):
    config = from_file("~/.oci/config", config_profile)
    return oci.identity.IdentityClient(config), config["tenancy"]

def list_all_users(identity_client, tenancy_ocid):
    users = []
    list_users_response = oci.pagination.list_call_get_all_results(
        identity_client.list_users,
        compartment_id=tenancy_ocid
    )
    for user in list_users_response.data:
        # Only consider active, non-deleted users
        if user.lifecycle_state == "ACTIVE":
            users.append(user)
    return users

def user_has_mfa(identity_client, user_id):
    # If this returns 0 devices, user has no TOTP MFA devices.
    devices = oci.pagination.list_call_get_all_results(
        identity_client.list_mfa_totp_devices,
        user_id=user_id
    )
    return len(devices.data) > 0

def main():
    identity_client, tenancy_ocid = get_identity_client()

    users = list_all_users(identity_client, tenancy_ocid)

    users_without_mfa = []
    for user in users:
        if not user_has_mfa(identity_client, user.id):
            users_without_mfa.append(user)

    print("Users without MFA configured (TOTP):")
    for user in users_without_mfa:
        print(f"- {user.name} ({user.id})")

    # Optional: here you can integrate with Monitoring / Notifications:
    #   - Push a custom metric
    #   - Send to OCI Logging
    #   - Publish to an OCI Notifications (ONS) topic
    #
    # Example stub:
    # send_metric_to_monitoring(len(users_without_mfa))
    # send_list_to_notifications(users_without_mfa)

if __name__ == "__main__":
    main()

​

3. (Optional) Push a Custom Metric to OCI Monitoring

import oci
from datetime import datetime, timezone

def send_metric_to_monitoring(non_mfa_count, namespace="security_custom", compartment_ocid=None):
    config = oci.config.from_file()
    monitoring_client = oci.monitoring.MonitoringClient(config)

    if not compartment_ocid:
        compartment_ocid = config["tenancy"]

    metric_data = oci.monitoring.models.MetricDataDetails(
        namespace=namespace,
        compartment_id=compartment_ocid,
        name="non_mfa_users_count",
        dimensions={"tenancy": compartment_ocid},
        datapoints=[
            oci.monitoring.models.Datapoint(
                timestamp=datetime.now(timezone.utc),
                value=float(non_mfa_count)
            )
        ],
        metadata={}
    )

    post_metric_data_details = oci.monitoring.models.PostMetricDataDetails(
        metric_data=[metric_data]
    )

    monitoring_client.post_metric_data(post_metric_data_details)

1. Go to Monitoring → Metrics.
2. Select namespace security_custom.
3. Create an alarm on non_mfa_users_count > 0 for some periods.
4. Attach an Alarm Destination (Notifications topic → email/Slack/etc.).

​

4. (Optional) Send a Notification with List of Non-MFA Users

def send_list_to_notifications(users_without_mfa, topic_ocid):
    config = oci.config.from_file()
    ons_client = oci.ons.NotificationDataPlaneClient(config)

    body_lines = ["Users without MFA:"]
    for user in users_without_mfa:
        body_lines.append(f"- {user.name} ({user.id})")
    body = "\n".join(body_lines)

    ons_client.publish_message(
        topic_id=topic_ocid,
        message_details=oci.ons.models.MessageDetails(
            title="OCI IAM: Users without MFA",
            body=body
        )
    )

​

5. Automate the Monitoring

• Run this script on:
  • A VM with cron
  • OCI DevOps build job
  • As an OCI Function with a cron Events rule (converted to Functions runtime)

​

6. Enforcing MFA (Separate from Monitoring)

• Classic IAM:
  • Configure MFA in your Identity Provider / Console sign-on policy (if using identity domains, use Authentication Policies and Rules).
  • Make MFA mandatory for interactive login to the Console.
• Identity Domains (recommended):
  • Create an Authentication Policy that requires MFA for console access (or all access).
  • Optionally enforce MFA enrollment at first login.