How to check whether MFA is enabled on your cloud account

TL;DR — To check whether multi-factor authentication (MFA, a second sign-in step like an app code or security key) is on, open your cloud provider dashboard and go to your account’s security or sign-in settings. The most common answer is shown as "MFA enabled," "2-step verification on," or a list of registered methods; if you only see a button like "Set up MFA," it is usually not enabled yet. Reading time: ~5 min

Goal

When you finish, you will be able to point to the exact place in your cloud account where MFA status is shown and confirm one of two observable results: either MFA is enabled and at least one sign-in method is registered, or MFA is not enabled and you know that from the dashboard or CLI output.

Prerequisites

• Your cloud account login
• Permission to view your own account security settings; for organization-managed accounts, you may also need access to the identity or admin area
• A web browser
• If your provider uses single sign-on (SSO, sign-in through your company identity provider), your company login
• Optional: provider CLI already installed if you want a command-line check
• Optional CLI versions to check first:
  • AWS CLI v2 — check with:

aws --version

• Azure CLI — check with:

az version

• Google Cloud CLI — check with:

gcloud version

Steps

Step 1: Identify how you sign in to the cloud account

Use the sign-in page you normally use for this cloud account and note which of these applies:

• Direct cloud account login with email/password
• Company-managed login through SSO
• Root/owner account versus a regular user account

If you are already signed in, open the account menu in the top-right corner and look for one of these exact areas:

• Profile → Security
• Account → Security
• User menu → My Account → Sign-in and security
• Organization/Workspace → Users → [your user]

What you should see when this succeeds: a page with labels such as Security, Authentication, Sign-in methods, 2-step verification, or Multi-factor authentication.

Step 2: Check the MFA status in the dashboard

In your provider’s dashboard, open the security page for your user account and look for one of these exact states:

Common menu paths by provider family vary, but these are the usual places:

• Your provider dashboard → Account/Profile → Security
• Your provider dashboard → Identity/IAM (access management) → Users → [your user] → Security
• For company-managed accounts: your identity provider dashboard → My Account → Security info or → Sign-in methods

What you should see when this succeeds: a visible status line or method list showing either an enabled factor or a setup prompt.

Step 3: Confirm that at least one MFA method is actually registered

On the same page, open the section usually named one of these:

• Authentication methods
• Sign-in methods
• Security keys
• Authenticator app
• Two-factor devices

A valid enabled state usually includes at least one registered method, such as:

• Authenticator app
• Security key
• Passkey
• SMS code
• Hardware token

What you should see when this succeeds: at least one method listed as Active, Registered, Default, or Primary.

Step 4: If the account is company-managed, check the identity provider too

If the cloud account says Managed by your organization or redirects you to a company login page, check MFA where your company controls sign-in.

Use one of these common paths in your identity provider portal:

• My Account → Security info
• Profile → Security → Sign-in methods
• Account Settings → Two-factor authentication
• Admin center → Users → [your user] → Authentication methods (if you are an admin)

Use this rule:

• If the cloud provider says authentication is organization-managed, the identity provider is the source of truth.
• If the identity provider shows no second factor registered, treat MFA as not enabled for that cloud account login.

What you should see when this succeeds: the identity portal lists a second factor, or clearly says none is configured.

Step 5: Optional CLI check for common providers

If you prefer a command-line check, use the command for your provider below.

For AWS IAM user MFA devices:

aws iam list-mfa-devices --user-name YOUR_IAM_USERNAME

Expected success signal: output contains a non-empty MFADevices list. If it is empty, that IAM user has no MFA device attached.

For AWS account summary flags:

aws iam get-account-summary

Expected success signal: in SummaryMap, values like AccountMFAEnabled or MFADevices are greater than 0 for the account context they apply to.

For Azure signed-in user authentication methods:

az login
az rest --method GET --url "https://graph.microsoft.com/v1.0/me/authentication/methods"

Expected success signal: the JSON response contains one or more authentication method objects beyond just a password method.

For Google Cloud, MFA is often enforced through Google Account or Google Workspace, so check the account security page first. If your organization manages it, use the Admin or Account security UI rather than assuming gcloud alone can prove MFA status.

What you should see when this succeeds: command output that clearly shows registered MFA devices or methods.

Verify it works

Use one or more of these checks to prove the result end to end:

1. Sign out of the cloud dashboard.
2. Sign back in with your normal username and password.
3. Watch for a second prompt such as an app code, push approval, passkey prompt, or security key touch.

If you want a simple flow to compare against, it should look like this:

[You] ---- 1. enter password ----> [Cloud Sign-In]
[Cloud Sign-In] ---- 2. prompt for MFA ----> [Second Factor]
[Second Factor] ---- 3. approve/code ----> [Cloud Sign-In]
[Cloud Sign-In] ---- 4. access granted ----> [Dashboard]

Expected result:

• If MFA is enabled, you are asked for a second factor after the password step.
• If you go straight from password to dashboard with no second step, MFA is usually not enabled for that login path, or the session is being remembered on that device.

For CLI verification, rerun the same command from Step 5 and confirm the device or method list is still present.

Common pitfalls

You checked the wrong account

Mistake: You verified MFA on a personal account, but the cloud resources are under a different work or organization account.

Symptom: The dashboard says MFA is on, but the actual production login still does not ask for a second factor.

Fix: Sign out, then sign back in to the exact account or organization that owns the cloud resources, and repeat Account/Profile → Security.

The account uses SSO, but you only checked the cloud provider page

Mistake: You looked in the cloud dashboard even though sign-in is controlled by your company identity provider.

Symptom: The cloud page says Managed by your organization or does not let you edit sign-in methods.

Fix: Open your company identity portal and check My Account → Security info or the equivalent user authentication page there.

A remembered device hides the MFA prompt

Mistake: You tested sign-in on a browser that was previously marked as trusted.

Symptom: MFA appears enabled in settings, but you are not prompted during sign-in.

Fix: Test in a private/incognito window, or remove trusted devices from the security page and sign in again.

You found a method list, but nothing is active

Mistake: A method was started but not completed, or an old device is listed but disabled.

Symptom: The page shows an authenticator or phone entry, but status is Pending, Inactive, or Not default with no active factor.

Fix: Use the security page to complete enrollment until the method shows Active, Registered, or Default.

You checked an IAM user, but you actually log in as the root/owner account

Mistake: In providers that separate account owner and IAM users, you checked the wrong identity.

Symptom: CLI shows no MFA device for the IAM user, but the account owner login behaves differently, or vice versa.

Fix: Verify the exact identity you use to sign in, then check that specific user or owner account’s security page and MFA device list.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.