Harbour ITMenu

Powered by Office Sentry 2.2.0

You're in the demo. Three fictional clients with made-up people. Look around freely: nothing can be changed, and it all resets every night.Get Office Sentry
Clients/Northwind Traders

Northwind Traders

northwindtraders.onmicrosoft.com
Monthly review

Admins and roles

Every admin role holder with MFA, PIM and sign-in status, and a break-glass check.

All clients
Download PDFXLSX
Privileged accounts
3
People with a permanent admin role
Global Administrators
2Since 19 Jul 2026: from 2 to 2
Keep between 2 and 4
Admins without MFA
1
Not set up at all
Break-glass accounts
1
Emergency accounts kept out of Conditional Access
Using PIM
Not checked
Needs Entra ID P2
Not checked

PIM (admins activating a role only when they need it) needs Entra ID P2, which this tenant doesn't have, so every role shown is permanent.

Privileged role holders 5Break-glass accounts 1Other roles 1

Privileged role holders 5

3 to review CSV

Everyone who holds a role that can change security settings, users or data. Problems first.

By role
  1. Exchange Administrator2
  2. Global Administrator2
  3. Global Administrator (eligible)1
  4. Groups Administrator (limited scope)1
AccountKindRolesHow assignedMFA set upMFA required byLast sign-inSynced from on-premises
breakglass@northwindtraders.example criticalUserGlobal AdministratorPermanentNoNothingNot checkedUnknown
g#EXT#@northwindtraders.example highGuestExchange AdministratorPermanentUnknownRequire MFA for all usersNeverNo
Some app mediumAppExchange AdministratorPermanent
ann.patel@northwindtraders.exampleUserGlobal Administrator, Groups Administrator (limited scope)PermanentYesRequire MFA for all users30 Sep 2026No
eve.sinclair@northwindtraders.exampleUserGlobal Administrator (eligible)Eligible (PIM)UnknownRequire MFA for all usersNot checkedUnknown

Break-glass accounts 1

1 to review CSV

Emergency Global Administrator accounts for when normal sign-in breaks. Microsoft recommends two, cloud-only, excluded from Conditional Access, signing in with a FIDO2 key or passkey kept somewhere safe.

AccountCloud-onlyOn the .onmicrosoft.com domainExcluded fromSign-in methodsLast sign-in
breakglass@northwindtraders.example highUnknownNoRequire MFA for all usersNoneNot checked
Why we think it's break-glass: Named like one, Excluded from Conditional AccessWhat to check: No MFA method: Microsoft requires MFA for admin portals, so it may not get in; Use the .onmicrosoft.com domain so it works if a custom domain breaks

Other roles 1

CSV

Roles with narrower or read-only permissions.

AccountKindRolesHow assigned
robert.hughes@northwindtraders.exampleUserDirectory Readers, Groups Administrator (limited scope)Permanent

Data from Admin roles (), Users (), MFA registration (), Conditional Access ().