Fabrikam Dental Group
fabrikam.onmicrosoft.com
Phishing-resistant
9 of 54
Passkey, security key, Windows Hello or certificate
Admins without phishing-resistant
2
Admin roles should need a passkey or security key
Phone is the only second factor
4
Text message or voice call
Passwordless ready
0 of 54
Can sign in without a password
No self-service reset
1
Can't reset a forgotten password themselves
Password never expires
0
Fine with MFA: expiry is no longer advised
Password over a year old
0
Matters most without MFA
Never signed in, old password
0
Probably still the first password
Strongest method 4Methods registered 5Sign-in methods by person 54Sign-in methods policy 3Authentication strengths in Conditional Access 0Password age 54Password expiry policy 3
Each enabled member counted once, by the strongest method they have.
| Strength | People | Admins | Share of members | What it means |
|---|---|---|---|---|
| Phishing-resistant | 9 | 0 | 17% | Bound to the real Microsoft sign-in page, so a fake page can't relay it. |
| Authenticator app or token | 15 | 1 | 28% | Strong, but a convincing fake sign-in page can relay a code or push approval. |
| Phone (SMS or voice call) medium | 4 | 0 | 7% | Weakest second factor: texts and calls can be intercepted or moved to another SIM. |
| None medium | 26 | 1 | 48% | No second factor: the password alone gets in. |
How many enabled members have each method. People usually have more than one.
Enabled members and what they can sign in with, weakest first and admins at the top. Who hasn't set up MFA at all, and whether it's required, is in MFA coverage.
| Account | Admin | Admin roles | Strongest method | Methods | Asked for first | Passwordless | Self‑service reset |
|---|---|---|---|---|---|---|---|
| breakglass@fabrikam.example high | Yes | Global Administrator | None | No | No | ||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| anna.kowalski@ | Yes | Global Administrator, Groups Administrator (limited scope) | Authenticator app or token | Authenticator app | Authenticator app | No | Yes |
What to do: Admin without a phishing-resistant method: register a passkey or security key. | |||||||
| aaron.smith@fabrikam.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| aisha.brown@fabrikam.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| amelia.khan@fabrikam.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| arthur.williams@ | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| ava.jackson@fabrikam.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| ava.moore@fabrikam.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| ava.thomas@fabrikam.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| chloe.jackson@ | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| george.williams@ | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| henry.roberts@ | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| isla.scott@fabrikam.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| jack.lee@fabrikam.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| jack.roberts@fabrikam.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| lily.khan@fabrikam.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| lily.watson@fabrikam.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| lily.white@fabrikam.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| megan.king@fabrikam.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| noah.wood@fabrikam.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| olivia.taylor@ | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| owen.scott@fabrikam.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| rhys.walker@fabrikam.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| ruby.davies@fabrikam.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| ruby.wood@fabrikam.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| thomas.johnson@ | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| zara.edwards@fabrikam.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| george.baker@fabrikam.example medium | No | Phone (SMS or voice call) | Mobile phone (SMS or call) | No | Unknown | ||
What to do: Only a phone: set up the Authenticator app (or a passkey), then keep the phone as a backup at most. | |||||||
| owen.robinson@ | No | Phone (SMS or voice call) | Mobile phone (SMS or call) | No | Unknown | ||
What to do: Only a phone: set up the Authenticator app (or a passkey), then keep the phone as a backup at most. | |||||||
| owen.turner@fabrikam.example medium | No | Phone (SMS or voice call) | Mobile phone (SMS or call) | No | Unknown | ||
What to do: Only a phone: set up the Authenticator app (or a passkey), then keep the phone as a backup at most. | |||||||
| thomas.allen@fabrikam.example medium | No | Phone (SMS or voice call) | Mobile phone (SMS or call) | No | Unknown | ||
What to do: Only a phone: set up the Authenticator app (or a passkey), then keep the phone as a backup at most. | |||||||
| amelia.jackson@ | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| ella.hughes@fabrikam.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| ethan.jones@fabrikam.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| jack.ward@fabrikam.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| leo.harrison@fabrikam.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| megan.green@fabrikam.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| noah.harris@fabrikam.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| owen.patel@fabrikam.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| owen.smith@fabrikam.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| rhys.scott@fabrikam.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| ruby.clark@fabrikam.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| thomas.robinson@ | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| william.lewis@ | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| william.wood@fabrikam.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| arthur.lee@fabrikam.example | No | Phishing-resistant | Windows Hello for Business, Authenticator app | No | Unknown | ||
| callum.turner@ | No | Phishing-resistant | Passkey, Authenticator app | No | Unknown | ||
| ella.evans@fabrikam.example | No | Phishing-resistant | Passkey, Authenticator app | No | Unknown | ||
| freya.evans@fabrikam.example | No | Phishing-resistant | Passkey, Authenticator app | No | Unknown | ||
| george.walker@ | No | Phishing-resistant | Windows Hello for Business, Authenticator app | No | Unknown | ||
| oscar.smith@fabrikam.example | No | Phishing-resistant | Windows Hello for Business, Authenticator app | No | Unknown | ||
| owen.khan@fabrikam.example | No | Phishing-resistant | Windows Hello for Business, Authenticator app | No | Unknown | ||
| priya.williams@ | No | Phishing-resistant | Windows Hello for Business, Authenticator app | No | Unknown | ||
| rhys.hall@fabrikam.example | No | Phishing-resistant | Windows Hello for Business, Authenticator app | No | Unknown | ||
Which methods people may register and use, from the tenant's authentication methods policy, against what's recommended for a small business.
| Setting | Current | Recommended | Why |
|---|---|---|---|
| Authenticator shows where the sign-in is from low | Off | On (Microsoft managed turns it on) | Helps people spot a sign-in that isn't theirs. |
| Text message (SMS) low | On for All users except Break glass | Off, once people use Authenticator | Texts can be intercepted or moved to another SIM. |
| System-preferred MFA (asks for the strongest method a person has) low | Off | On, or Microsoft managed | Otherwise people are asked for their own default, often a text message. |
Authentication strengths in Conditional Access 0
No Conditional Access policy requires an authentication strength. Start with one requiring Phishing-resistant MFA for admin roles, once admins have a passkey.
When each enabled member's password was last set. An old password matters most without MFA; an account that has never signed in may still have the password it was created with. Problems first, then oldest first.
How often cloud-only accounts on each domain must change their password. Microsoft and the NCSC now advise against regular expiry when everyone has MFA: forced changes lead to weaker, predictable passwords. Accounts synced from on-premises AD follow AD's policy instead.
| Domain | Signs in with | Passwords expire after | Reminder before expiry | Recommended |
|---|---|---|---|---|
| fabrikam.example | Microsoft Entra ID | Never | Never, with MFA required for everyone | |
| fabrikam.onmicrosoft.com | Microsoft Entra ID | Never | Never, with MFA required for everyone | |
| parked.example low | Microsoft Entra ID | 90 days | 14 days | Never, with MFA required for everyone |
Data from MFA registration (), Sign-in methods policy (), Users (), Admin roles (), Conditional Access (), Directory sync ().