Harbour ITMenu

Powered by Office Sentry 2.3.0

You're in the demo. Three fictional clients with made-up people. Look around freely: nothing can be changed, and it all resets every night.Get Office Sentry
Clients/Northwind Traders

Northwind Traders

northwindtraders.onmicrosoft.com
Monthly review

Passwords and sign-in methods

How people sign in and how strong that is: methods by strength, admins without phishing-resistant MFA, the methods policy, and password age and expiry.

All clients
Download PDFXLSX
Phishing-resistant
6 of 36
Passkey, security key, Windows Hello or certificate
Admins without phishing-resistant
2
Admin roles should need a passkey or security key
Phone is the only second factor
3
Text message or voice call
Passwordless ready
0 of 36
Can sign in without a password
No self-service reset
1
Can't reset a forgotten password themselves
Password never expires
0
Fine with MFA: expiry is no longer advised
Password over a year old
0
Matters most without MFA
Never signed in, old password
0
Probably still the first password
Strongest method 4Methods registered 5Sign-in methods by person 36Sign-in methods policy 1Authentication strengths in Conditional Access 0Password age 36Password expiry policy 3

Strongest method 4

2 to review CSV

Each enabled member counted once, by the strongest method they have.

By strength
  1. Phishing-resistant6
  2. Authenticator app or token14
  3. Phone (SMS or voice call)3
  4. None13
StrengthPeopleAdminsShare of membersWhat it means
Phishing-resistant6017%Bound to the real Microsoft sign-in page, so a fake page can't relay it.
Authenticator app or token14139%Strong, but a convincing fake sign-in page can relay a code or push approval.
Phone (SMS or voice call) medium308%Weakest second factor: texts and calls can be intercepted or moved to another SIM.
None medium13136%No second factor: the password alone gets in.

Methods registered 5

CSV

How many enabled members have each method. People usually have more than one.

By method
  1. Authenticator app20
  2. Authenticator code (OATH)13
  3. Windows Hello for Business5
  4. Mobile phone (SMS or call)3
  5. Passkey1
StrengthPeopleAdmins
Phishing-resistant50
Phishing-resistant10
Authenticator app or token201
Authenticator app or token130
Phone (SMS or voice call) low30

Sign-in methods by person 36

17 to review CSV

Enabled members and what they can sign in with, weakest first and admins at the top. Who hasn't set up MFA at all, and whether it's required, is in MFA coverage.

AccountAdminAdmin rolesStrongest methodMethodsAsked for firstPasswordlessSelf‑service reset
breakglass@northwindtraders.example highYesGlobal AdministratorNoneNoNo
What to do: No second factor. Set up MFA first (see MFA coverage).
ann.patel@northwindtraders.example mediumYesGlobal Administrator, Groups Administrator (limited scope)Authenticator app or tokenAuthenticator appAuthenticator appNoYes
What to do: Admin without a phishing-resistant method: register a passkey or security key.
alfie.roberts@northwindtraders.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
alfie.scott@northwindtraders.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
grace.wilson@northwindtraders.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
hannah.robinson@northwindtraders.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
leo.morris@northwindtraders.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
leo.wright@northwindtraders.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
maya.martin@northwindtraders.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
olivia.scott@northwindtraders.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
owen.taylor@northwindtraders.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
rhys.clark@northwindtraders.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
sophie.smith@northwindtraders.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
thomas.clarke@northwindtraders.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
arthur.evans@northwindtraders.example mediumNoPhone (SMS or voice call)Mobile phone (SMS or call)NoUnknown
What to do: Only a phone: set up the Authenticator app (or a passkey), then keep the phone as a backup at most.
mia.hughes@northwindtraders.example mediumNoPhone (SMS or voice call)Mobile phone (SMS or call)NoUnknown
What to do: Only a phone: set up the Authenticator app (or a passkey), then keep the phone as a backup at most.
zara.jackson@northwindtraders.example mediumNoPhone (SMS or voice call)Mobile phone (SMS or call)NoUnknown
What to do: Only a phone: set up the Authenticator app (or a passkey), then keep the phone as a backup at most.
aaron.watson@northwindtraders.exampleNoAuthenticator app or tokenAuthenticator app, Authenticator code (OATH)NoUnknown
amelia.watson@northwindtraders.exampleNoAuthenticator app or tokenAuthenticator app, Authenticator code (OATH)NoUnknown
ella.baker@northwindtraders.exampleNoAuthenticator app or tokenAuthenticator app, Authenticator code (OATH)NoUnknown
ethan.green@northwindtraders.exampleNoAuthenticator app or tokenAuthenticator app, Authenticator code (OATH)NoUnknown
george.roberts@northwindtraders.exampleNoAuthenticator app or tokenAuthenticator app, Authenticator code (OATH)NoUnknown
george.robinson@northwindtraders.exampleNoAuthenticator app or tokenAuthenticator app, Authenticator code (OATH)NoUnknown
hannah.patel@northwindtraders.exampleNoAuthenticator app or tokenAuthenticator app, Authenticator code (OATH)NoUnknown
harry.lee@northwindtraders.exampleNoAuthenticator app or tokenAuthenticator app, Authenticator code (OATH)NoUnknown
imogen.edwards@northwindtraders.exampleNoAuthenticator app or tokenAuthenticator app, Authenticator code (OATH)NoUnknown
megan.lee@northwindtraders.exampleNoAuthenticator app or tokenAuthenticator app, Authenticator code (OATH)NoUnknown
olivia.smith@northwindtraders.exampleNoAuthenticator app or tokenAuthenticator app, Authenticator code (OATH)NoUnknown
rhys.moore@northwindtraders.exampleNoAuthenticator app or tokenAuthenticator app, Authenticator code (OATH)NoUnknown
ruby.taylor@northwindtraders.exampleNoAuthenticator app or tokenAuthenticator app, Authenticator code (OATH)NoUnknown
grace.taylor@northwindtraders.exampleNoPhishing-resistantPasskey, Authenticator appNoUnknown
isla.evans@northwindtraders.exampleNoPhishing-resistantWindows Hello for Business, Authenticator appNoUnknown
jacob.hughes@northwindtraders.exampleNoPhishing-resistantWindows Hello for Business, Authenticator appNoUnknown
leo.evans@northwindtraders.exampleNoPhishing-resistantWindows Hello for Business, Authenticator appNoUnknown
owen.white@northwindtraders.exampleNoPhishing-resistantWindows Hello for Business, Authenticator appNoUnknown
ruby.hill@northwindtraders.exampleNoPhishing-resistantWindows Hello for Business, Authenticator appNoUnknown

Sign-in methods policy 1 of 12

CSV

Which methods people may register and use, from the tenant's authentication methods policy, against what's recommended for a small business.

Current: Microsoft managed, for All users, can be skipped for 1 dayRemove Clear filters
SettingCurrentRecommendedWhy
Registration campaign (asks people to set up Authenticator at sign-in)Microsoft managed, for All users, can be skipped for 1 dayOn, or Microsoft managedMoves people off text messages and calls.

Authentication strengths in Conditional Access 0

No Conditional Access policy requires an authentication strength. Start with one requiring Phishing-resistant MFA for admin roles, once admins have a passkey.

Password age 36

CSV

When each enabled member's password was last set. An old password matters most without MFA; an account that has never signed in may still have the password it was created with. Problems first, then oldest first.

AccountPassword last changedNever expiresSynced from on‑premisesLast sign‑inMFA set up
thomas.clarke@northwindtraders.exampleUnknownNoNo2 Jun 2026No
hannah.robinson@northwindtraders.exampleUnknownNoNo7 Apr 2026No
sophie.smith@northwindtraders.exampleUnknownNoNo22 Jan 2026No
megan.lee@northwindtraders.exampleUnknownNoNo10 Oct 2026Yes
grace.taylor@northwindtraders.exampleUnknownNoNo12 Oct 2026Yes
owen.white@northwindtraders.exampleUnknownNoNo10 Oct 2026Yes
ruby.taylor@northwindtraders.exampleUnknownNoNo30 Sep 2026Yes
olivia.smith@northwindtraders.exampleUnknownNoNo8 Oct 2026Yes
grace.wilson@northwindtraders.exampleUnknownNoNo11 Oct 2026No
zara.jackson@northwindtraders.exampleUnknownNoNo11 Oct 2026Yes
leo.evans@northwindtraders.exampleUnknownNoNo12 Oct 2026Yes
amelia.watson@northwindtraders.exampleUnknownNoNo11 Oct 2026Yes
george.robinson@northwindtraders.exampleUnknownNoNo11 Oct 2026Yes
hannah.patel@northwindtraders.exampleUnknownNoNo5 Oct 2026Yes
ethan.green@northwindtraders.exampleUnknownNoNo12 Oct 2026Yes
ruby.hill@northwindtraders.exampleUnknownNoNo6 Oct 2026Yes
mia.hughes@northwindtraders.exampleUnknownNoNo11 Oct 2026Yes
rhys.moore@northwindtraders.exampleUnknownNoNo10 Oct 2026Yes
leo.wright@northwindtraders.exampleUnknownNoNo29 Sep 2026No
leo.morris@northwindtraders.exampleUnknownNoNo11 Oct 2026No
isla.evans@northwindtraders.exampleUnknownNoNo5 Oct 2026Yes
owen.taylor@northwindtraders.exampleUnknownNoNo11 Oct 2026No
maya.martin@northwindtraders.exampleUnknownNoNo12 Oct 2026No
arthur.evans@northwindtraders.exampleUnknownNoNo6 Oct 2026Yes
harry.lee@northwindtraders.exampleUnknownNoNo11 Oct 2026Yes
alfie.scott@northwindtraders.exampleUnknownNoNo5 Oct 2026No
rhys.clark@northwindtraders.exampleUnknownNoNo12 Oct 2026No
ella.baker@northwindtraders.exampleUnknownNoNo12 Oct 2026Yes
alfie.roberts@northwindtraders.exampleUnknownNoNo30 Sep 2026No
olivia.scott@northwindtraders.exampleUnknownNoNo10 Oct 2026No
jacob.hughes@northwindtraders.exampleUnknownNoNo11 Oct 2026Yes
george.roberts@northwindtraders.exampleUnknownNoNo29 Sep 2026Yes
aaron.watson@northwindtraders.exampleUnknownNoNo10 Oct 2026Yes
imogen.edwards@northwindtraders.exampleUnknownNoNo10 Oct 2026Yes
ann.patel@northwindtraders.exampleUnknownNoNo30 Sep 2026Yes
breakglass@northwindtraders.exampleUnknownNoNo30 Sep 2026No

Password expiry policy 3

CSV

How often cloud-only accounts on each domain must change their password. Microsoft and the NCSC now advise against regular expiry when everyone has MFA: forced changes lead to weaker, predictable passwords. Accounts synced from on-premises AD follow AD's policy instead.

DomainSigns in withPasswords expire afterReminder before expiryRecommended
northwindtraders.exampleMicrosoft Entra IDNeverNever, with MFA required for everyone
northwindtraders.onmicrosoft.comMicrosoft Entra IDNeverNever, with MFA required for everyone
parked.example lowMicrosoft Entra ID90 days14 daysNever, with MFA required for everyone

Data from MFA registration (), Sign-in methods policy (), Users (), Admin roles (), Conditional Access (), Directory sync ().