U.S. flag

An official website of the United States government

Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock () or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Microsoft 365® Access Control

Report Information

Date Issued
Report Number
2024-17522
Report Type
Audit
Description
The Office of the Inspector General performed an audit to determine if the Tennessee Valley Authority’s (TVA’s) corporate deployment of Microsoft 365® was configured to require and enforce the use of multi-factor authentication (MFA) for all accounts.  Our scope was limited to MFA managed through Microsoft Entra® ID.  We determined TVA has required and enforced the use of MFA for all accounts with limited exclusions for service accounts. Additionally, we reviewed a sample of service accounts and determined they were approved and documented in accordance with the applicable tech standard.  However, we identified internal control deficiencies related to MFA enforcement access policies and MFA applicability to enterprise applications. Specifically, we found (1) an MFA enforcement access policy applicable to 26 of 2,448 enterprise applications was not fully implemented in accordance with the applicable TVA tech standard and identified best practices, and (2) 1,802 of 2,448 enterprise applications were not covered by an MFA enforcement access policy. This report specifically identifies Microsoft, a nongovernmental organization/business entity. Pursuant to the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023, Pub. L. No. 117-263 §5274, any such organization may submit a written response to the report within 30 days, clarifying or providing additional context for each instance within the report in which the organization is specifically identified.  Any response provided for that purpose will be appended to the final, published report. If you have any questions about this process, please contact Jeffrey McKenzie at (865) 633-7374 or jtmckenzie@tvaoig.gov within 30 days of publication.
Joint Report
No
Agency Wide
Yes (agency-wide)
Questioned Costs
$0
Funds for Better Use
$0
View report on Oversight.gov

Recommendations

Revise Tennessee Valley Authority’s Tech Standard, Authentication - Multifactor Authentication Implementation Requirements, to include the appropriate reauthentication frequency and authorized exclusions.

Revise multi-factor authentication enforcement access policies to include all networks as required by Tennessee Valley Authority’s Tech Standard, Authentication – Multifactor Authentication Implementation Requirements.

Reconcile enterprise applications in Microsoft Entra® to validate their lifecycle and multi-factor authentication status.

Implement a process to periodically validate the lifecycle and multi-factor authentication status of enterprise applications in Microsoft Entra® with appropriate system owners and cloud administrators.