Learn more on [Microsoft Azure platform is HITRUST CSF certified](https://azure.microsoft.com/blog/microsoft-azure-achieves-hitrust-csf-certification/), which includes identity and access management:
* [Microsoft Entra ID](~/fundamentals/whatis.md), formerly known as Azure Active Directory
* Rights management with [Microsoft Purview](https://techcommunity.microsoft.com/t5/healthcare-and-life-sciences/microsoft-purview-compliance-score-part-3-hitrust/ba-p/3614103)
* [Microsoft Entra multifactor authentication (MFA)](~/identity/authentication/concept-mfa-howitworks.md)
| HITRUST control, objective, and HSR | Microsoft Entra guidance and recommendation |
| - | - |
|**CSF Control V11**<br>01.b User Registration<br><br>**Control category**<br>Access Control – User Registration and De-Registration<br><br>**Control specification**<br>The organization uses a formal user registration and deregistration process to enable assignment of access rights.<br><br>**Objective name**<br>Authorized Access to Information Systems<br><br>**HIPAA Security Rule**<br>§ 164.308(a)(3)(ii)(A)<br>§ 164.308(a)(4)(i)<br>§ 164.308(a)(3)(ii)(B)<br>§ 164.308(a)(4)(ii)(C)<br>§ 164.308(a)(4)(ii)(B)<br>§ 164.308(a)(5)(ii)(D)<br>§ 164.312(a)(2)(i)<br>§ 164.312(a)(2)(ii)<br>§ 164.312(d) |[Microsoft Entra ID](~/fundamentals/whatis.md) is an identity platform for verification, [authentication](~/identity/authentication/overview-authentication.md), and credential management when an identity signs in to their device, application, or server. It’s a cloud-based identity and access management service with single sign-on (SSO), MFA, and [Conditional Access](~/identity/conditional-access/overview.md) to guard against security attacks. Authentication ensures only authorized identities gain access to resources and data.<br><br>[Lifecycle workflows](~/id-governance/understanding-lifecycle-workflows.md) enable identity governance to automate the joiner, mover, leaver (JML) lifecycle. It centralizes the workflow process by using the built-in templates or you create custom workflows. This practice helps reduce, or potentially remove, manual tasks for organizational JML strategy requirements. On the Azure portal, navigate to **ID Governance** in the Microsoft Entra ID menu to review or configure tasks for your organizational requirements.<br><br>[Microsoft Entra Connect](~/identity/hybrid/connect/how-to-connect-install-roadmap.md) integrates on-premises directories with Microsoft Entra ID, supporting the use of single identities to access on-premises applications and cloud services such as Microsoft 365. It orchestrates synchronization between Active Directory (AD) and Microsoft Entra ID. To get started with Microsoft Entra Connect, review the prerequisites. Note the server requirements and how to prepare your Microsoft Entra tenant for management.<br><br>[Microsoft Entra Connect Sync](~/identity/hybrid/cloud-sync/tutorial-pilot-aadc-aadccp.md) is a provisioning agent managed on the cloud, which supports synchronization to Microsoft Entra ID from a multi-forest disconnected AD environment. Use the lightweight agents with Microsoft Entra Connect. We recommend password hash sync to help reduce the number of passwords and protect against leaked credential detection.|
|**CSF Control V11**<br>01.c Privilege Management<br><br>**Control category**<br>Access Control – Privileged Accounts<br><br>**Control specification**<br>The organization ensures authorized user accounts are registered, tracked, and periodically validated to prevent unauthorized access to information systems<br><br>**Objective name**<br>Authorized Access to Information Systems<br><br>**HIPAA Security Rule**<br>§ 164.308(a)(1)(i)<br>§ 164.308(a)(1)(ii)(B)<br>§ 164.308(a)(2)<br>§ 164.308(a)(3)(ii)(B)<br>§ 164.308(a)(3)(ii)(A)<br>§ 164.308(a)(4)(i)<br>§ 164.308(a)(4)(ii)(B)<br>§ 164.308(a)(4)(ii)(C)<br>§ 164.310(a)(2)(ii)<br>§ 164.310(a)(1)<br>§ 164.310(a)(2)(iii)<br>§ 164.312(a)(1)|[Privileged Identity Management (PIM)](~/id-governance/privileged-identity-management/pim-configure.md) is a service in Microsoft Entra ID to manage, control and monitor access to important resources in an organization. It minimizes the number of people with access to secure information to help prevent malicious actors from getting access.<br><br>PIM has time and approval-based access, to mitigate the risks of excessive, unnecessary, or misused access permissions. It helps identify and analyze privileged accounts to ensure you provide just enough access (JEA) for a user to perform their role.<br><br>[Monitoring and generating alerts](~/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts.md) prevent suspicious activities, listing the users and roles that trigger the alert, while reducing the risk of unauthorized access. Customize alerts for your organizational security strategy.<br><br>[Access reviews](~/id-governance/access-reviews-overview.md) enable organizations to manage role assignments and group membership efficiently. Maintain security and compliance by evaluating which accounts have access and ensure access is revoked when needed, thus minimizing the risks from excessive or outdated permissions. |
|**CSF Control V11**<br>0.1d User Password Management<br><br>**Control category**<br>Access Control - Procedures<br><br>**Control specification**<br>To ensure authorized user accounts are registered, tracked, and periodically validated to prevent unauthorized access to information systems.<br><br>**Objective name**<br>Authorized Access to Information Systems<br><br>**HIPAA Security Rule**<br>§164.308(a)(5)(ii)(D)|[Password management](/azure/security/fundamentals/identity-management-best-practices) is a critical aspect of security infrastructure. Align with best practices to create a robust security posture, Microsoft Entra ID helps facilitate with a comprehensive strategy support: [SSO](~/identity/enterprise-apps/add-application-portal-setup-sso.md) and [MFA](~/identity/authentication/concept-mfa-howitworks.md) also [passwordless authentication](~/identity/authentication/concept-authentication-passwordless.md), such as FIDO2 security keys and Windows Hello for Business (WHfB) mitigate user risk and streamline the user authentication experience.<br><br>Microsoft Entra Password Protection detects, and blocks, known weak passwords. It incorporates password [policies](~/identity/authentication/tutorial-configure-custom-password-protection.md) and has the flexibility to define a custom password list and build a password management strategy to safeguard password use.<br><br>HITRUST password length and strength requirements align with the National Institute of Standards and Technology [NIST 800-63B](https://pages.nist.gov/800-63-3/sp800-63b.html), which includes a minimum of eight characters for a password, or 15 characters for accounts with the most privileged access. Complexity measures include at least one number and/or special character and at least one upper- and lower-case letter for privileged accounts.|
|**CSF Control V11**<br>01.p Secure Log-on Procedures<br><br>**Control category**<br>Access Control – Secure Logon<br><br>**Control specification**<br>The organization controls access to information assets using a secure logon procedure.<br><br>**Objective name**<br>Operating System Access Control<br><br>**HIPAA Security Rule**<br>§ 164.308(a)(5)(i)<br>§ 164.308(a)(5)(ii)(C)<br>§ 164.308(a)(5)(ii)(D)|Secure sign-in is the process to authenticate an identity securely when they attempt to access a system.<br><br>**The control focuses on the [operating system](/azure/governance/policy/samples/hipaa-hitrust-9-2), Microsoft Entra services help strengthen the secure sign in.**<br><br>[Conditional Access](~/identity/conditional-access/overview.md) policies help organizations restrict access to approved applications, resources, and ensure devices are secure. Microsoft Entra ID analyzes the signals from Conditional Access [policies](~/identity/conditional-access/concept-conditional-access-policies.md) from the identity, location, or device to automate the decision and enforce organizational policies for access to resources and data.<br><br>[Role-based access control (RBAC)](~/identity/role-based-access-control/custom-overview.md) helps you manage access and managed resources in your organization. RBAC helps implement the principle of least privilege, ensuring users have the permissions they need to perform their tasks. This action minimizes the risk of accidental or intentional misconfiguration.<br><br>As noted for control 0.1d User Password Management, passwordless authentication uses biometrics because they are difficult to forge, thus providing more secure authentication. |
Learn more on [Microsoft Azure platform is HITRUST CSF certified](https://azure.microsoft.com/blog/microsoft-azure-achieves-hitrust-csf-certification/), which includes identity and access management:
* [Microsoft Entra ID](~/fundamentals/what-is-entra.md), formerly known as Azure Active Directory
* Rights management with [Microsoft Purview](https://techcommunity.microsoft.com/t5/healthcare-and-life-sciences/microsoft-purview-compliance-score-part-3-hitrust/ba-p/3614103)
* [Microsoft Entra multifactor authentication (MFA)](~/identity/authentication/concept-mfa-howitworks.md)
| HITRUST control, objective, and HSR | Microsoft Entra guidance and recommendation |
| - | - |
|**CSF Control V11**<br>01.b User Registration<br><br>**Control category**<br>Access Control – User Registration and De-Registration<br><br>**Control specification**<br>The organization uses a formal user registration and deregistration process to enable assignment of access rights.<br><br>**Objective name**<br>Authorized Access to Information Systems<br><br>**HIPAA Security Rule**<br>§ 164.308(a)(3)(ii)(A)<br>§ 164.308(a)(4)(i)<br>§ 164.308(a)(3)(ii)(B)<br>§ 164.308(a)(4)(ii)(C)<br>§ 164.308(a)(4)(ii)(B)<br>§ 164.308(a)(5)(ii)(D)<br>§ 164.312(a)(2)(i)<br>§ 164.312(a)(2)(ii)<br>§ 164.312(d) |[Microsoft Entra ID](~/fundamentals/what-is-entra.md) is an identity platform for verification, [authentication](~/identity/authentication/overview-authentication.md), and credential management when an identity signs in to their device, application, or server. It’s a cloud-based identity and access management service with single sign-on (SSO), MFA, and [Conditional Access](~/identity/conditional-access/overview.md) to guard against security attacks. Authentication ensures only authorized identities gain access to resources and data.<br><br>[Lifecycle workflows](~/id-governance/understanding-lifecycle-workflows.md) enable identity governance to automate the joiner, mover, leaver (JML) lifecycle. It centralizes the workflow process by using the built-in templates or you create custom workflows. This practice helps reduce, or potentially remove, manual tasks for organizational JML strategy requirements. On the Azure portal, navigate to **ID Governance** in the Microsoft Entra ID menu to review or configure tasks for your organizational requirements.<br><br>[Microsoft Entra Connect](~/identity/hybrid/connect/how-to-connect-install-roadmap.md) integrates on-premises directories with Microsoft Entra ID, supporting the use of single identities to access on-premises applications and cloud services such as Microsoft 365. It orchestrates synchronization between Active Directory (AD) and Microsoft Entra ID. To get started with Microsoft Entra Connect, review the prerequisites. Note the server requirements and how to prepare your Microsoft Entra tenant for management.<br><br>[Microsoft Entra Connect Sync](~/identity/hybrid/cloud-sync/tutorial-pilot-aadc-aadccp.md) is a provisioning agent managed on the cloud, which supports synchronization to Microsoft Entra ID from a multi-forest disconnected AD environment. Use the lightweight agents with Microsoft Entra Connect. We recommend password hash sync to help reduce the number of passwords and protect against leaked credential detection.|
|**CSF Control V11**<br>01.c Privilege Management<br><br>**Control category**<br>Access Control – Privileged Accounts<br><br>**Control specification**<br>The organization ensures authorized user accounts are registered, tracked, and periodically validated to prevent unauthorized access to information systems<br><br>**Objective name**<br>Authorized Access to Information Systems<br><br>**HIPAA Security Rule**<br>§ 164.308(a)(1)(i)<br>§ 164.308(a)(1)(ii)(B)<br>§ 164.308(a)(2)<br>§ 164.308(a)(3)(ii)(B)<br>§ 164.308(a)(3)(ii)(A)<br>§ 164.308(a)(4)(i)<br>§ 164.308(a)(4)(ii)(B)<br>§ 164.308(a)(4)(ii)(C)<br>§ 164.310(a)(2)(ii)<br>§ 164.310(a)(1)<br>§ 164.310(a)(2)(iii)<br>§ 164.312(a)(1)|[Privileged Identity Management (PIM)](~/id-governance/privileged-identity-management/pim-configure.md) is a service in Microsoft Entra ID to manage, control and monitor access to important resources in an organization. It minimizes the number of people with access to secure information to help prevent malicious actors from getting access.<br><br>PIM has time and approval-based access, to mitigate the risks of excessive, unnecessary, or misused access permissions. It helps identify and analyze privileged accounts to ensure you provide just enough access (JEA) for a user to perform their role.<br><br>[Monitoring and generating alerts](~/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts.md) prevent suspicious activities, listing the users and roles that trigger the alert, while reducing the risk of unauthorized access. Customize alerts for your organizational security strategy.<br><br>[Access reviews](~/id-governance/access-reviews-overview.md) enable organizations to manage role assignments and group membership efficiently. Maintain security and compliance by evaluating which accounts have access and ensure access is revoked when needed, thus minimizing the risks from excessive or outdated permissions. |
|**CSF Control V11**<br>0.1d User Password Management<br><br>**Control category**<br>Access Control - Procedures<br><br>**Control specification**<br>To ensure authorized user accounts are registered, tracked, and periodically validated to prevent unauthorized access to information systems.<br><br>**Objective name**<br>Authorized Access to Information Systems<br><br>**HIPAA Security Rule**<br>§164.308(a)(5)(ii)(D)|[Password management](/azure/security/fundamentals/identity-management-best-practices) is a critical aspect of security infrastructure. Align with best practices to create a robust security posture, Microsoft Entra ID helps facilitate with a comprehensive strategy support: [SSO](~/identity/enterprise-apps/add-application-portal-setup-sso.md) and [MFA](~/identity/authentication/concept-mfa-howitworks.md) also [passwordless authentication](~/identity/authentication/concept-authentication-passwordless.md), such as FIDO2 security keys and Windows Hello for Business (WHfB) mitigate user risk and streamline the user authentication experience.<br><br>Microsoft Entra Password Protection detects, and blocks, known weak passwords. It incorporates password [policies](~/identity/authentication/tutorial-configure-custom-password-protection.md) and has the flexibility to define a custom password list and build a password management strategy to safeguard password use.<br><br>HITRUST password length and strength requirements align with the National Institute of Standards and Technology [NIST 800-63B](https://pages.nist.gov/800-63-3/sp800-63b.html), which includes a minimum of eight characters for a password, or 15 characters for accounts with the most privileged access. Complexity measures include at least one number and/or special character and at least one upper- and lower-case letter for privileged accounts.|
|**CSF Control V11**<br>01.p Secure Log-on Procedures<br><br>**Control category**<br>Access Control – Secure Logon<br><br>**Control specification**<br>The organization controls access to information assets using a secure logon procedure.<br><br>**Objective name**<br>Operating System Access Control<br><br>**HIPAA Security Rule**<br>§ 164.308(a)(5)(i)<br>§ 164.308(a)(5)(ii)(C)<br>§ 164.308(a)(5)(ii)(D)|Secure sign-in is the process to authenticate an identity securely when they attempt to access a system.<br><br>**The control focuses on the [operating system](/azure/governance/policy/samples/hipaa-hitrust-9-2), Microsoft Entra services help strengthen the secure sign in.**<br><br>[Conditional Access](~/identity/conditional-access/overview.md) policies help organizations restrict access to approved applications, resources, and ensure devices are secure. Microsoft Entra ID analyzes the signals from Conditional Access [policies](~/identity/conditional-access/concept-conditional-access-policies.md) from the identity, location, or device to automate the decision and enforce organizational policies for access to resources and data.<br><br>[Role-based access control (RBAC)](~/identity/role-based-access-control/custom-overview.md) helps you manage access and managed resources in your organization. RBAC helps implement the principle of least privilege, ensuring users have the permissions they need to perform their tasks. This action minimizes the risk of accidental or intentional misconfiguration.<br><br>As noted for control 0.1d User Password Management, passwordless authentication uses biometrics because they are difficult to forge, thus providing more secure authentication. |