fix(azure): remove duplicated findings in entra_user_with_vm_access_has_mfa (#9914)

prowler/CHANGELOG.md

@@ -29,6 +29,10 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - Update Azure Defender service metadata to new format [(#9618)](https://github.com/prowler-cloud/prowler/pull/9618)
 - Make AWS cross-account checks configurable through `trusted_account_ids` config parameter [(#9692)](https://github.com/prowler-cloud/prowler/pull/9692)
 
+### Fixed
+
+- Duplicated findings in `entra_user_with_vm_access_has_mfa` check when user has multiple VM access roles [(#9914)](https://github.com/prowler-cloud/prowler/pull/9914)
+
 ---
 
 ## [5.17.0] (Prowler v5.17.0)

prowler/providers/azure/services/entra/entra_user_with_vm_access_has_mfa/entra_user_with_vm_access_has_mfa.py

@@ -15,6 +15,7 @@ from prowler.providers.azure.services.iam.iam_client import iam_client
 class entra_user_with_vm_access_has_mfa(Check):
     def execute(self) -> Check_Report_Azure:
         findings = []
+        already_reported = set()
 
         for users in entra_client.users.values():
             for user in users.values():
@@ -22,6 +23,9 @@ class entra_user_with_vm_access_has_mfa(Check):
                     subscription_name,
                     role_assigns,
                 ) in iam_client.role_assignments.items():
+                    if (user.id, subscription_name) in already_reported:
+                        continue
+
                     for assignment in role_assigns.values():
                         if (
                             assignment.agent_type == "User"
@@ -48,5 +52,7 @@ class entra_user_with_vm_access_has_mfa(Check):
                                 report.status_extended = f"User {user.name} can access VMs in subscription {subscription_name} but it has MFA."
 
                             findings.append(report)
+                            already_reported.add((user.id, subscription_name))
+                            break
 
         return findings