Northwind Traders
northwindtraders.onmicrosoft.com
Phishing-resistant
6 of 35
Passkey, security key, Windows Hello or certificate
Admins without phishing-resistant
1
Admin roles should need a passkey or security key
Phone is the only second factor
3
Text message or voice call
Passwordless ready
0 of 35
Can sign in without a password
No self-service reset
0
Can't reset a forgotten password themselves
Password never expires
0
Fine with MFA: expiry is no longer advised
Password over a year old
0
Matters most without MFA
Never signed in, old password
0
Probably still the first password
Strongest method 4Methods registered 5Sign-in methods by person 35Sign-in methods policy 12Authentication strengths in Conditional Access 0Password age 35Password expiry policy 3
Each enabled member counted once, by the strongest method they have.
| People | Admins | Share of members | What it means |
|---|---|---|---|
| 6 | 0 | 17% | Bound to the real Microsoft sign-in page, so a fake page can't relay it. |
| 14 | 1 | 40% | Strong, but a convincing fake sign-in page can relay a code or push approval. |
| 3 medium | 0 | 9% | Weakest second factor: texts and calls can be intercepted or moved to another SIM. |
| 12 medium | 0 | 34% | No second factor: the password alone gets in. |
How many enabled members have each method. People usually have more than one.
Enabled members and what they can sign in with, weakest first and admins at the top. Who hasn't set up MFA at all, and whether it's required, is in MFA coverage.
| Account | Admin | Admin roles | Strongest method | Methods | Asked for first | Passwordless | Self-service reset |
|---|---|---|---|---|---|---|---|
| ann.patel@northwindtraders.example medium | Yes | Global Administrator, Groups Administrator (limited scope) | Authenticator app or token | Authenticator app | Authenticator app | No | Yes |
What to do: Admin without a phishing-resistant method: register a passkey or security key. | |||||||
| alfie.roberts@northwindtraders.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| alfie.scott@northwindtraders.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| grace.wilson@northwindtraders.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| hannah.robinson@northwindtraders.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| leo.morris@northwindtraders.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| leo.wright@northwindtraders.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| maya.martin@northwindtraders.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| olivia.scott@northwindtraders.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| owen.taylor@northwindtraders.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| rhys.clark@northwindtraders.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| sophie.smith@northwindtraders.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| thomas.clarke@northwindtraders.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| arthur.evans@northwindtraders.example medium | No | Phone (SMS or voice call) | Mobile phone (SMS or call) | No | Unknown | ||
What to do: Only a phone: set up the Authenticator app (or a passkey), then keep the phone as a backup at most. | |||||||
| mia.hughes@northwindtraders.example medium | No | Phone (SMS or voice call) | Mobile phone (SMS or call) | No | Unknown | ||
What to do: Only a phone: set up the Authenticator app (or a passkey), then keep the phone as a backup at most. | |||||||
| zara.jackson@northwindtraders.example medium | No | Phone (SMS or voice call) | Mobile phone (SMS or call) | No | Unknown | ||
What to do: Only a phone: set up the Authenticator app (or a passkey), then keep the phone as a backup at most. | |||||||
| aaron.watson@northwindtraders.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| amelia.watson@northwindtraders.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| ella.baker@northwindtraders.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| ethan.green@northwindtraders.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| george.roberts@northwindtraders.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| george.robinson@northwindtraders.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| hannah.patel@northwindtraders.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| harry.lee@northwindtraders.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| imogen.edwards@northwindtraders.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| megan.lee@northwindtraders.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| olivia.smith@northwindtraders.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| rhys.moore@northwindtraders.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| ruby.taylor@northwindtraders.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| grace.taylor@northwindtraders.example | No | Phishing-resistant | Passkey, Authenticator app | No | Unknown | ||
| isla.evans@northwindtraders.example | No | Phishing-resistant | Windows Hello for Business, Authenticator app | No | Unknown | ||
| jacob.hughes@northwindtraders.example | No | Phishing-resistant | Windows Hello for Business, Authenticator app | No | Unknown | ||
| leo.evans@northwindtraders.example | No | Phishing-resistant | Windows Hello for Business, Authenticator app | No | Unknown | ||
| owen.white@northwindtraders.example | No | Phishing-resistant | Windows Hello for Business, Authenticator app | No | Unknown | ||
| ruby.hill@northwindtraders.example | No | Phishing-resistant | Windows Hello for Business, Authenticator app | No | Unknown | ||
Which methods people may register and use, from the tenant's authentication methods policy, against what's recommended for a small business.
| Setting | Current | Recommended | Why |
|---|---|---|---|
| Passkeys and security keys (FIDO2) | On for Break glass | On | Needed for phishing-resistant sign-in, which admins should use. |
| Microsoft Authenticator | On for All users | On | The second factor most people should use. |
| Authenticator shows which app is signing in | Microsoft managed | On (Microsoft managed turns it on) | Helps people spot a sign-in that isn't theirs. |
| Authenticator shows where the sign-in is from low | Off | On (Microsoft managed turns it on) | Helps people spot a sign-in that isn't theirs. |
| Text message (SMS) low | On for All users except Break glass | Off, once people use Authenticator | Texts can be intercepted or moved to another SIM. |
| Voice call | Off | Off | Calls can be redirected, and are easy to approve by mistake. |
| Email one-time passcode | On for All users | Off, unless guests or password reset need it | Not a second factor for members; only for password reset and guests. |
| Temporary Access Pass | Off | On, for setting up passkeys | A time-limited pass for setting up a new phone or passkey. |
| Registration campaign (asks people to set up Authenticator at sign-in) | Microsoft managed, for All users, can be skipped for 1 day | On, or Microsoft managed | Moves people off text messages and calls. |
| System-preferred MFA (asks for the strongest method a person has) low | Off | On, or Microsoft managed | Otherwise people are asked for their own default, often a text message. |
| People can report an MFA prompt they didn't expect | Microsoft managed | On | A reported prompt blocks the account's risky sign-ins and alerts admins. |
| Methods managed in this policy (not the old MFA and SSPR settings) | Yes | Yes | Microsoft has retired the old per-user MFA and SSPR method settings. |
Authentication strengths in Conditional Access 0
No Conditional Access policy requires an authentication strength. Start with one requiring Phishing-resistant MFA for admin roles, once admins have a passkey.
When each enabled member's password was last set. An old password matters most without MFA; an account that has never signed in may still have the password it was created with. Problems first, then oldest first.
How often cloud-only accounts on each domain must change their password. Microsoft and the NCSC now advise against regular expiry when everyone has MFA: forced changes lead to weaker, predictable passwords. Accounts synced from on-premises AD follow AD's policy instead.
| Domain | Signs in with | Passwords expire after | Reminder before expiry | Recommended |
|---|---|---|---|---|
| northwindtraders.example | Microsoft Entra ID | Never | Never, with MFA required for everyone | |
| northwindtraders.onmicrosoft.com | Microsoft Entra ID | Never | Never, with MFA required for everyone | |
| parked.example low | Microsoft Entra ID | 90 days | 14 days | Never, with MFA required for everyone |
Data from MFA registration (), Sign-in methods policy (), Users (), Admin roles (), Conditional Access (), Directory sync ().