Which action should an administrator take after identifying privileged accounts without MFA using the CrowdStrike Identity Analyzer?

The CrowdStrike Identity Analyzer is designed to identify security vulnerabilities and misconfigurations within an identity infrastructure, such as privileged accounts lacking Multi-Factor Authentication (MFA). The direct and appropriate remediation for this specific finding is to enforce MFA on these accounts. Applying conditional access policies is the standard, scalable, and least disruptive method to mandate MFA for specific users or groups (like privileged accounts) within modern identity providers such as Azure Active Directory. This action directly resolves the identified security gap while maintaining operational continuity.

B. Manually change the passwords of all identified accounts. This action does not address the core vulnerability, which is the absence of a second authentication factor (MFA). A compromised password would still grant access.
C. Revoke all privileges from the affected accounts immediately. This is an overly drastic and disruptive measure for a configuration finding. It should be reserved for active security incidents, not for proactive hardening.
D. Disable the accounts permanently to prevent unauthorized access. This is an extreme and operationally disruptive action. Disabling accounts is not the standard procedure for enforcing a security policy like MFA on active, legitimate users.

1. CrowdStrike Official Documentation - Falcon Identity Protection: The Falcon Identity Protection solution, which includes the Identity Analyzer, is designed to provide visibility into identity-based risks and enforce security policies. The documentation emphasizes using risk signals to enforce adaptive controls. The logical remediation for identifying a lack of MFA is to enforce it. The primary mechanism for this in integrated environments is Conditional Access.

Source: CrowdStrike. (2023). Falcon Identity Protection Data Sheet. "Enforce conditional access and adaptive MFA: Use real-time risk scores to enforce adaptive, risk-based conditional access policies in your IdP, such as Azure AD, to block risky users or require step-up authentication." (Page 2). This shows the intended remediation path is policy enforcement.

2. CrowdStrike Official Documentation - Falcon Zero Trust: The concept of Zero Trust, which underpins CrowdStrike's identity solutions, requires continuous verification. A key part of this is ensuring strong authentication for all users, especially privileged ones.

Source: CrowdStrike. (2023). Achieving Zero Trust with CrowdStrike. "A core tenet of Zero Trust is to never trust and always verify... This includes enforcing strong authentication through MFA and using conditional access policies to grant access based on the real-time risk of the user and device." (Section: "Verify Explicitly"). This document establishes enforcing MFA via conditional access as a core principle and best practice.