Harbour ITMenu

Powered by Office Sentry 2.2.0

You're in the demo. Three fictional clients with made-up people. Look around freely: nothing can be changed, and it all resets every night.Get Office Sentry
Clients/Northwind Traders

Northwind Traders

northwindtraders.onmicrosoft.com
Monthly review

Admins and roles

Every admin role holder with MFA, PIM and sign-in status, and a break-glass check.

All clients
Download PDFXLSX
Privileged accounts
3
People with a permanent admin role
Global Administrators
2Since 19 Jul 2026: from 2 to 2
Keep between 2 and 4
Admins without MFA
1
Not set up at all
Break-glass accounts
1
Emergency accounts kept out of Conditional Access
Using PIM
Not checked
Needs Entra ID P2
Not checked

PIM (admins activating a role only when they need it) needs Entra ID P2, which this tenant doesn't have, so every role shown is permanent.

Privileged role holders 2Break-glass accounts 1Other roles 1

Privileged role holders 2 of 5

3 to review CSV

Everyone who holds a role that can change security settings, users or data. Problems first.

MFA set up: UnknownRemove Clear filters
By role
  1. Exchange Administrator1
  2. Global Administrator (eligible)1
AccountKindRolesHow assignedMFA set upMFA required byLast sign-inSynced from on-premises
g#EXT#@northwindtraders.example highGuestExchange AdministratorPermanentUnknownRequire MFA for all usersNeverNo
What to check: Guest account with an admin role; No sign-in for 90+ days
eve.sinclair@northwindtraders.exampleUserGlobal Administrator (eligible)Eligible (PIM)UnknownRequire MFA for all usersNot checkedUnknown

Break-glass accounts 1

1 to review CSV

Emergency Global Administrator accounts for when normal sign-in breaks. Microsoft recommends two, cloud-only, excluded from Conditional Access, signing in with a FIDO2 key or passkey kept somewhere safe.

AccountCloud-onlyOn the .onmicrosoft.com domainExcluded fromSign-in methodsLast sign-in
breakglass@northwindtraders.example highUnknownNoRequire MFA for all usersNoneNot checked
Why we think it's break-glass: Named like one, Excluded from Conditional AccessWhat to check: No MFA method: Microsoft requires MFA for admin portals, so it may not get in; Use the .onmicrosoft.com domain so it works if a custom domain breaks

Other roles 1

CSV

Roles with narrower or read-only permissions.

AccountKindRolesHow assigned
robert.hughes@northwindtraders.exampleUserDirectory Readers, Groups Administrator (limited scope)Permanent

Data from Admin roles (), Users (), MFA registration (), Conditional Access ().