Harbour ITMenu

Powered by Office Sentry 2.3.1

You're in the demo. Three fictional clients with made-up people. Look around freely: nothing can be changed, and it all resets every night.Get Office Sentry
Clients/Fabrikam Dental Group

Fabrikam Dental Group

fabrikam.onmicrosoft.com
Monthly review

Passwords and sign-in methods

How people sign in and how strong that is: methods by strength, admins without phishing-resistant MFA, the methods policy, and password age and expiry.

All clients
Download PDFXLSX
Phishing-resistant
9 of 54
Passkey, security key, Windows Hello or certificate
Admins without phishing-resistant
2
Admin roles should need a passkey or security key
Phone is the only second factor
4
Text message or voice call
Passwordless ready
0 of 54
Can sign in without a password
No self-service reset
1
Can't reset a forgotten password themselves
Password never expires
0
Fine with MFA: expiry is no longer advised
Password over a year old
0
Matters most without MFA
Never signed in, old password
0
Probably still the first password
Strongest method 4Methods registered 5Sign-in methods by person 54Sign-in methods policy 2Authentication strengths in Conditional Access 0Password age 54Password expiry policy 3

Strongest method 4

2 to review CSV

Each enabled member counted once, by the strongest method they have.

By strength
  1. Phishing-resistant9
  2. Authenticator app or token15
  3. Phone (SMS or voice call)4
  4. None26
PeopleAdminsShare of membersWhat it means
9017%Bound to the real Microsoft sign-in page, so a fake page can't relay it.
15128%Strong, but a convincing fake sign-in page can relay a code or push approval.
4 medium07%Weakest second factor: texts and calls can be intercepted or moved to another SIM.
26 medium148%No second factor: the password alone gets in.

Methods registered 5

CSV

How many enabled members have each method. People usually have more than one.

By method
  1. Authenticator app24
  2. Authenticator code (OATH)14
  3. Windows Hello for Business6
  4. Mobile phone (SMS or call)4
  5. Passkey3
MethodStrengthPeopleAdmins
Windows Hello for BusinessPhishing-resistant60
PasskeyPhishing-resistant30
Authenticator appAuthenticator app or token241
Authenticator code (OATH)Authenticator app or token140
Mobile phone (SMS or call) lowPhone (SMS or voice call)40

Sign-in methods by person 54

31 to review CSV

Enabled members and what they can sign in with, weakest first and admins at the top. Who hasn't set up MFA at all, and whether it's required, is in MFA coverage.

AccountAdminAdmin rolesStrongest methodMethodsAsked for firstPasswordlessSelf‑service reset
breakglass@fabrikam.example highYesGlobal AdministratorNoneNoNo
What to do: No second factor. Set up MFA first (see MFA coverage).
anna.kowalski@fabrikam.example mediumYesGlobal Administrator, Groups Administrator (limited scope)Authenticator app or tokenAuthenticator appAuthenticator appNoYes
What to do: Admin without a phishing-resistant method: register a passkey or security key.
aaron.smith@fabrikam.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
aisha.brown@fabrikam.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
amelia.khan@fabrikam.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
arthur.williams@fabrikam.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
ava.jackson@fabrikam.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
ava.moore@fabrikam.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
ava.thomas@fabrikam.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
chloe.jackson@fabrikam.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
george.williams@fabrikam.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
henry.roberts@fabrikam.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
isla.scott@fabrikam.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
jack.lee@fabrikam.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
jack.roberts@fabrikam.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
lily.khan@fabrikam.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
lily.watson@fabrikam.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
lily.white@fabrikam.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
megan.king@fabrikam.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
noah.wood@fabrikam.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
olivia.taylor@fabrikam.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
owen.scott@fabrikam.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
rhys.walker@fabrikam.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
ruby.davies@fabrikam.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
ruby.wood@fabrikam.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
thomas.johnson@fabrikam.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
zara.edwards@fabrikam.example mediumNoNoneNoUnknown
What to do: No second factor. Set up MFA first (see MFA coverage).
george.baker@fabrikam.example mediumNoPhone (SMS or voice call)Mobile phone (SMS or call)NoUnknown
What to do: Only a phone: set up the Authenticator app (or a passkey), then keep the phone as a backup at most.
owen.robinson@fabrikam.example mediumNoPhone (SMS or voice call)Mobile phone (SMS or call)NoUnknown
What to do: Only a phone: set up the Authenticator app (or a passkey), then keep the phone as a backup at most.
owen.turner@fabrikam.example mediumNoPhone (SMS or voice call)Mobile phone (SMS or call)NoUnknown
What to do: Only a phone: set up the Authenticator app (or a passkey), then keep the phone as a backup at most.
thomas.allen@fabrikam.example mediumNoPhone (SMS or voice call)Mobile phone (SMS or call)NoUnknown
What to do: Only a phone: set up the Authenticator app (or a passkey), then keep the phone as a backup at most.
amelia.jackson@fabrikam.exampleNoAuthenticator app or tokenAuthenticator app, Authenticator code (OATH)NoUnknown
ella.hughes@fabrikam.exampleNoAuthenticator app or tokenAuthenticator app, Authenticator code (OATH)NoUnknown
ethan.jones@fabrikam.exampleNoAuthenticator app or tokenAuthenticator app, Authenticator code (OATH)NoUnknown
jack.ward@fabrikam.exampleNoAuthenticator app or tokenAuthenticator app, Authenticator code (OATH)NoUnknown
leo.harrison@fabrikam.exampleNoAuthenticator app or tokenAuthenticator app, Authenticator code (OATH)NoUnknown
megan.green@fabrikam.exampleNoAuthenticator app or tokenAuthenticator app, Authenticator code (OATH)NoUnknown
noah.harris@fabrikam.exampleNoAuthenticator app or tokenAuthenticator app, Authenticator code (OATH)NoUnknown
owen.patel@fabrikam.exampleNoAuthenticator app or tokenAuthenticator app, Authenticator code (OATH)NoUnknown
owen.smith@fabrikam.exampleNoAuthenticator app or tokenAuthenticator app, Authenticator code (OATH)NoUnknown
rhys.scott@fabrikam.exampleNoAuthenticator app or tokenAuthenticator app, Authenticator code (OATH)NoUnknown
ruby.clark@fabrikam.exampleNoAuthenticator app or tokenAuthenticator app, Authenticator code (OATH)NoUnknown
thomas.robinson@fabrikam.exampleNoAuthenticator app or tokenAuthenticator app, Authenticator code (OATH)NoUnknown
william.lewis@fabrikam.exampleNoAuthenticator app or tokenAuthenticator app, Authenticator code (OATH)NoUnknown
william.wood@fabrikam.exampleNoAuthenticator app or tokenAuthenticator app, Authenticator code (OATH)NoUnknown
arthur.lee@fabrikam.exampleNoPhishing-resistantWindows Hello for Business, Authenticator appNoUnknown
callum.turner@fabrikam.exampleNoPhishing-resistantPasskey, Authenticator appNoUnknown
ella.evans@fabrikam.exampleNoPhishing-resistantPasskey, Authenticator appNoUnknown
freya.evans@fabrikam.exampleNoPhishing-resistantPasskey, Authenticator appNoUnknown
george.walker@fabrikam.exampleNoPhishing-resistantWindows Hello for Business, Authenticator appNoUnknown
oscar.smith@fabrikam.exampleNoPhishing-resistantWindows Hello for Business, Authenticator appNoUnknown
owen.khan@fabrikam.exampleNoPhishing-resistantWindows Hello for Business, Authenticator appNoUnknown
priya.williams@fabrikam.exampleNoPhishing-resistantWindows Hello for Business, Authenticator appNoUnknown
rhys.hall@fabrikam.exampleNoPhishing-resistantWindows Hello for Business, Authenticator appNoUnknown

Sign-in methods policy 2 of 12

CSV

Which methods people may register and use, from the tenant's authentication methods policy, against what's recommended for a small business.

Recommended: On, or Microsoft managedRemove Clear filters
SettingCurrentRecommendedWhy
Registration campaign (asks people to set up Authenticator at sign-in)Microsoft managed, for All users, can be skipped for 1 dayOn, or Microsoft managedMoves people off text messages and calls.
System-preferred MFA (asks for the strongest method a person has) lowOffOn, or Microsoft managedOtherwise people are asked for their own default, often a text message.

Authentication strengths in Conditional Access 0

No Conditional Access policy requires an authentication strength. Start with one requiring Phishing-resistant MFA for admin roles, once admins have a passkey.

Password age 54

CSV

When each enabled member's password was last set. An old password matters most without MFA; an account that has never signed in may still have the password it was created with. Problems first, then oldest first.

AccountPassword last changedNever expiresSynced from on‑premisesLast sign‑inMFA set up
zara.edwards@fabrikam.exampleUnknownNoNo11 Jul 2026No
aisha.brown@fabrikam.exampleUnknownNoNo10 Mar 2026No
jack.lee@fabrikam.exampleUnknownNoNo6 Jun 2026No
aaron.smith@fabrikam.exampleUnknownNoNo25 Apr 2026No
rhys.walker@fabrikam.exampleUnknownNoNo8 Jun 2026No
noah.wood@fabrikam.exampleUnknownNoNo10 Feb 2026No
ruby.clark@fabrikam.exampleUnknownNoNo12 Oct 2026Yes
thomas.robinson@fabrikam.exampleUnknownNoNo15 Oct 2026Yes
ava.thomas@fabrikam.exampleUnknownNoNo8 Oct 2026No
thomas.allen@fabrikam.exampleUnknownNoNo8 Oct 2026Yes
george.walker@fabrikam.exampleUnknownNoNo13 Oct 2026Yes
ella.hughes@fabrikam.exampleUnknownNoNo14 Oct 2026Yes
william.lewis@fabrikam.exampleUnknownNoNo11 Oct 2026Yes
owen.smith@fabrikam.exampleUnknownNoNo15 Oct 2026Yes
amelia.jackson@fabrikam.exampleUnknownNoNo15 Oct 2026Yes
rhys.hall@fabrikam.exampleUnknownNoNo14 Oct 2026Yes
george.williams@fabrikam.exampleUnknownNoNo13 Oct 2026No
owen.scott@fabrikam.exampleUnknownNoNo14 Oct 2026No
ava.moore@fabrikam.exampleUnknownNoNo12 Oct 2026No
isla.scott@fabrikam.exampleUnknownNoNo15 Oct 2026No
priya.williams@fabrikam.exampleUnknownNoNo13 Oct 2026Yes
leo.harrison@fabrikam.exampleUnknownNoNo11 Oct 2026Yes
william.wood@fabrikam.exampleUnknownNoNo12 Oct 2026Yes
george.baker@fabrikam.exampleUnknownNoNo12 Oct 2026Yes
megan.king@fabrikam.exampleUnknownNoNo14 Oct 2026No
arthur.lee@fabrikam.exampleUnknownNoNo12 Oct 2026Yes
freya.evans@fabrikam.exampleUnknownNoNo3 Oct 2026Yes
arthur.williams@fabrikam.exampleUnknownNoNo14 Oct 2026No
ava.jackson@fabrikam.exampleUnknownNoNo11 Oct 2026No
jack.ward@fabrikam.exampleUnknownNoNo14 Oct 2026Yes
owen.khan@fabrikam.exampleUnknownNoNo13 Oct 2026Yes
noah.harris@fabrikam.exampleUnknownNoNo2 Oct 2026Yes
megan.green@fabrikam.exampleUnknownNoNo15 Oct 2026Yes
amelia.khan@fabrikam.exampleUnknownNoNo14 Oct 2026No
ethan.jones@fabrikam.exampleUnknownNoNo2 Oct 2026Yes
lily.khan@fabrikam.exampleUnknownNoNo14 Oct 2026No
rhys.scott@fabrikam.exampleUnknownNoNo15 Oct 2026Yes
callum.turner@fabrikam.exampleUnknownNoNo15 Oct 2026Yes
ruby.davies@fabrikam.exampleUnknownNoNo15 Oct 2026No
ruby.wood@fabrikam.exampleUnknownNoNo14 Oct 2026No
lily.watson@fabrikam.exampleUnknownNoNo14 Oct 2026No
henry.roberts@fabrikam.exampleUnknownNoNo8 Oct 2026No
lily.white@fabrikam.exampleUnknownNoNo14 Oct 2026No
olivia.taylor@fabrikam.exampleUnknownNoNo8 Oct 2026No
owen.turner@fabrikam.exampleUnknownNoNo14 Oct 2026Yes
jack.roberts@fabrikam.exampleUnknownNoNo14 Oct 2026No
owen.patel@fabrikam.exampleUnknownNoNo11 Oct 2026Yes
thomas.johnson@fabrikam.exampleUnknownNoNo12 Oct 2026No
ella.evans@fabrikam.exampleUnknownNoNo12 Oct 2026Yes
chloe.jackson@fabrikam.exampleUnknownNoNo12 Oct 2026No
oscar.smith@fabrikam.exampleUnknownNoNo15 Oct 2026Yes
owen.robinson@fabrikam.exampleUnknownNoNo14 Oct 2026Yes
anna.kowalski@fabrikam.exampleUnknownNoNo30 Sep 2026Yes
breakglass@fabrikam.exampleUnknownNoNo3 Oct 2026No

Password expiry policy 3

CSV

How often cloud-only accounts on each domain must change their password. Microsoft and the NCSC now advise against regular expiry when everyone has MFA: forced changes lead to weaker, predictable passwords. Accounts synced from on-premises AD follow AD's policy instead.

DomainSigns in withPasswords expire afterReminder before expiryRecommended
fabrikam.exampleMicrosoft Entra IDNeverNever, with MFA required for everyone
fabrikam.onmicrosoft.comMicrosoft Entra IDNeverNever, with MFA required for everyone
parked.example lowMicrosoft Entra ID90 days14 daysNever, with MFA required for everyone

Data from MFA registration (), Sign-in methods policy (), Users (), Admin roles (), Conditional Access (), Directory sync ().