Strength	People	Admins	Share of members	What it means
Phishing-resistant	9	0	17%	Bound to the real Microsoft sign-in page, so a fake page can't relay it.
Authenticator app or token	15	1	28%	Strong, but a convincing fake sign-in page can relay a code or push approval.
Phone (SMS or voice call) medium	4	0	8%	Weakest second factor: texts and calls can be intercepted or moved to another SIM.
None medium	25	0	47%	No second factor: the password alone gets in.

How many enabled members have each method. People usually have more than one.

By method

Method	Strength	People	Admins
Windows Hello for Business	Phishing-resistant	6	0
Passkey	Phishing-resistant	3	0
Authenticator app	Authenticator app or token	24	1
Authenticator code (OATH)	Authenticator app or token	14	0
Mobile phone (SMS or call) low	Phone (SMS or voice call)	4	0

Enabled members and what they can sign in with, weakest first and admins at the top. Who hasn't set up MFA at all, and whether it's required, is in MFA coverage.

Account	Admin	Admin roles	Strongest method	Methods	Asked for first	Passwordless	Self-service reset
anna.kowalski@fabrikam.example medium	Yes	Global Administrator, Groups Administrator (limited scope)	Authenticator app or token	Authenticator app	Authenticator app	No	Yes
What to do: Admin without a phishing-resistant method: register a passkey or security key.
aaron.smith@fabrikam.example medium	No		None			No	Unknown
What to do: No second factor. Set up MFA first (see MFA coverage).
aisha.brown@fabrikam.example medium	No		None			No	Unknown
What to do: No second factor. Set up MFA first (see MFA coverage).
amelia.khan@fabrikam.example medium	No		None			No	Unknown
What to do: No second factor. Set up MFA first (see MFA coverage).
arthur.williams@fabrikam.example medium	No		None			No	Unknown
What to do: No second factor. Set up MFA first (see MFA coverage).
ava.jackson@fabrikam.example medium	No		None			No	Unknown
What to do: No second factor. Set up MFA first (see MFA coverage).
ava.moore@fabrikam.example medium	No		None			No	Unknown
What to do: No second factor. Set up MFA first (see MFA coverage).
ava.thomas@fabrikam.example medium	No		None			No	Unknown
What to do: No second factor. Set up MFA first (see MFA coverage).
chloe.jackson@fabrikam.example medium	No		None			No	Unknown
What to do: No second factor. Set up MFA first (see MFA coverage).
george.williams@fabrikam.example medium	No		None			No	Unknown
What to do: No second factor. Set up MFA first (see MFA coverage).
henry.roberts@fabrikam.example medium	No		None			No	Unknown
What to do: No second factor. Set up MFA first (see MFA coverage).
isla.scott@fabrikam.example medium	No		None			No	Unknown
What to do: No second factor. Set up MFA first (see MFA coverage).
jack.lee@fabrikam.example medium	No		None			No	Unknown
What to do: No second factor. Set up MFA first (see MFA coverage).
jack.roberts@fabrikam.example medium	No		None			No	Unknown
What to do: No second factor. Set up MFA first (see MFA coverage).
lily.khan@fabrikam.example medium	No		None			No	Unknown
What to do: No second factor. Set up MFA first (see MFA coverage).
lily.watson@fabrikam.example medium	No		None			No	Unknown
What to do: No second factor. Set up MFA first (see MFA coverage).
lily.white@fabrikam.example medium	No		None			No	Unknown
What to do: No second factor. Set up MFA first (see MFA coverage).
megan.king@fabrikam.example medium	No		None			No	Unknown
What to do: No second factor. Set up MFA first (see MFA coverage).
noah.wood@fabrikam.example medium	No		None			No	Unknown
What to do: No second factor. Set up MFA first (see MFA coverage).
olivia.taylor@fabrikam.example medium	No		None			No	Unknown
What to do: No second factor. Set up MFA first (see MFA coverage).
owen.scott@fabrikam.example medium	No		None			No	Unknown
What to do: No second factor. Set up MFA first (see MFA coverage).
rhys.walker@fabrikam.example medium	No		None			No	Unknown
What to do: No second factor. Set up MFA first (see MFA coverage).
ruby.davies@fabrikam.example medium	No		None			No	Unknown
What to do: No second factor. Set up MFA first (see MFA coverage).
ruby.wood@fabrikam.example medium	No		None			No	Unknown
What to do: No second factor. Set up MFA first (see MFA coverage).
thomas.johnson@fabrikam.example medium	No		None			No	Unknown
What to do: No second factor. Set up MFA first (see MFA coverage).
zara.edwards@fabrikam.example medium	No		None			No	Unknown
What to do: No second factor. Set up MFA first (see MFA coverage).
george.baker@fabrikam.example medium	No		Phone (SMS or voice call)	Mobile phone (SMS or call)		No	Unknown
What to do: Only a phone: set up the Authenticator app (or a passkey), then keep the phone as a backup at most.
owen.robinson@fabrikam.example medium	No		Phone (SMS or voice call)	Mobile phone (SMS or call)		No	Unknown
What to do: Only a phone: set up the Authenticator app (or a passkey), then keep the phone as a backup at most.
owen.turner@fabrikam.example medium	No		Phone (SMS or voice call)	Mobile phone (SMS or call)		No	Unknown
What to do: Only a phone: set up the Authenticator app (or a passkey), then keep the phone as a backup at most.
thomas.allen@fabrikam.example medium	No		Phone (SMS or voice call)	Mobile phone (SMS or call)		No	Unknown
What to do: Only a phone: set up the Authenticator app (or a passkey), then keep the phone as a backup at most.
amelia.jackson@fabrikam.example	No		Authenticator app or token	Authenticator app, Authenticator code (OATH)		No	Unknown
ella.hughes@fabrikam.example	No		Authenticator app or token	Authenticator app, Authenticator code (OATH)		No	Unknown
ethan.jones@fabrikam.example	No		Authenticator app or token	Authenticator app, Authenticator code (OATH)		No	Unknown
jack.ward@fabrikam.example	No		Authenticator app or token	Authenticator app, Authenticator code (OATH)		No	Unknown
leo.harrison@fabrikam.example	No		Authenticator app or token	Authenticator app, Authenticator code (OATH)		No	Unknown
megan.green@fabrikam.example	No		Authenticator app or token	Authenticator app, Authenticator code (OATH)		No	Unknown
noah.harris@fabrikam.example	No		Authenticator app or token	Authenticator app, Authenticator code (OATH)		No	Unknown
owen.patel@fabrikam.example	No		Authenticator app or token	Authenticator app, Authenticator code (OATH)		No	Unknown
owen.smith@fabrikam.example	No		Authenticator app or token	Authenticator app, Authenticator code (OATH)		No	Unknown
rhys.scott@fabrikam.example	No		Authenticator app or token	Authenticator app, Authenticator code (OATH)		No	Unknown
ruby.clark@fabrikam.example	No		Authenticator app or token	Authenticator app, Authenticator code (OATH)		No	Unknown
thomas.robinson@fabrikam.example	No		Authenticator app or token	Authenticator app, Authenticator code (OATH)		No	Unknown
william.lewis@fabrikam.example	No		Authenticator app or token	Authenticator app, Authenticator code (OATH)		No	Unknown
william.wood@fabrikam.example	No		Authenticator app or token	Authenticator app, Authenticator code (OATH)		No	Unknown
arthur.lee@fabrikam.example	No		Phishing-resistant	Windows Hello for Business, Authenticator app		No	Unknown
callum.turner@fabrikam.example	No		Phishing-resistant	Passkey, Authenticator app		No	Unknown
ella.evans@fabrikam.example	No		Phishing-resistant	Passkey, Authenticator app		No	Unknown
freya.evans@fabrikam.example	No		Phishing-resistant	Passkey, Authenticator app		No	Unknown
george.walker@fabrikam.example	No		Phishing-resistant	Windows Hello for Business, Authenticator app		No	Unknown
oscar.smith@fabrikam.example	No		Phishing-resistant	Windows Hello for Business, Authenticator app		No	Unknown
owen.khan@fabrikam.example	No		Phishing-resistant	Windows Hello for Business, Authenticator app		No	Unknown
priya.williams@fabrikam.example	No		Phishing-resistant	Windows Hello for Business, Authenticator app		No	Unknown
rhys.hall@fabrikam.example	No		Phishing-resistant	Windows Hello for Business, Authenticator app		No	Unknown

Which methods people may register and use, from the tenant's authentication methods policy, against what's recommended for a small business.

Recommended: Yes Clear filters

Setting	Current	Recommended	Why
Methods managed in this policy (not the old MFA and SSPR settings)	Yes	Yes	Microsoft has retired the old per-user MFA and SSPR method settings.

Authentication strengths in Conditional Access 0

No Conditional Access policy requires an authentication strength. Start with one requiring Phishing-resistant MFA for admin roles, once admins have a passkey.

When each enabled member's password was last set. An old password matters most without MFA; an account that has never signed in may still have the password it was created with. Problems first, then oldest first.

Account	Password last changed	Never expires	Synced from on-premises	MFA set up
zara.edwards@fabrikam.example	Unknown	No	No	No
aisha.brown@fabrikam.example	Unknown	No	No	No
jack.lee@fabrikam.example	Unknown	No	No	No
aaron.smith@fabrikam.example	Unknown	No	No	No
rhys.walker@fabrikam.example	Unknown	No	No	No
noah.wood@fabrikam.example	Unknown	No	No	No
ruby.clark@fabrikam.example	Unknown	No	No	Yes
thomas.robinson@fabrikam.example	Unknown	No	No	Yes
ava.thomas@fabrikam.example	Unknown	No	No	No
thomas.allen@fabrikam.example	Unknown	No	No	Yes
george.walker@fabrikam.example	Unknown	No	No	Yes
ella.hughes@fabrikam.example	Unknown	No	No	Yes
william.lewis@fabrikam.example	Unknown	No	No	Yes
owen.smith@fabrikam.example	Unknown	No	No	Yes
amelia.jackson@fabrikam.example	Unknown	No	No	Yes
rhys.hall@fabrikam.example	Unknown	No	No	Yes
george.williams@fabrikam.example	Unknown	No	No	No
owen.scott@fabrikam.example	Unknown	No	No	No
ava.moore@fabrikam.example	Unknown	No	No	No
isla.scott@fabrikam.example	Unknown	No	No	No
priya.williams@fabrikam.example	Unknown	No	No	Yes
leo.harrison@fabrikam.example	Unknown	No	No	Yes
william.wood@fabrikam.example	Unknown	No	No	Yes
george.baker@fabrikam.example	Unknown	No	No	Yes
megan.king@fabrikam.example	Unknown	No	No	No
arthur.lee@fabrikam.example	Unknown	No	No	Yes
freya.evans@fabrikam.example	Unknown	No	No	Yes
arthur.williams@fabrikam.example	Unknown	No	No	No
ava.jackson@fabrikam.example	Unknown	No	No	No
jack.ward@fabrikam.example	Unknown	No	No	Yes
owen.khan@fabrikam.example	Unknown	No	No	Yes
noah.harris@fabrikam.example	Unknown	No	No	Yes
megan.green@fabrikam.example	Unknown	No	No	Yes
amelia.khan@fabrikam.example	Unknown	No	No	No
ethan.jones@fabrikam.example	Unknown	No	No	Yes
lily.khan@fabrikam.example	Unknown	No	No	No
rhys.scott@fabrikam.example	Unknown	No	No	Yes
callum.turner@fabrikam.example	Unknown	No	No	Yes
ruby.davies@fabrikam.example	Unknown	No	No	No
ruby.wood@fabrikam.example	Unknown	No	No	No
lily.watson@fabrikam.example	Unknown	No	No	No
henry.roberts@fabrikam.example	Unknown	No	No	No
lily.white@fabrikam.example	Unknown	No	No	No
olivia.taylor@fabrikam.example	Unknown	No	No	No
owen.turner@fabrikam.example	Unknown	No	No	Yes
jack.roberts@fabrikam.example	Unknown	No	No	No
owen.patel@fabrikam.example	Unknown	No	No	Yes
thomas.johnson@fabrikam.example	Unknown	No	No	No
ella.evans@fabrikam.example	Unknown	No	No	Yes
chloe.jackson@fabrikam.example	Unknown	No	No	No
oscar.smith@fabrikam.example	Unknown	No	No	Yes
owen.robinson@fabrikam.example	Unknown	No	No	Yes
anna.kowalski@fabrikam.example	Unknown	No	No	Yes

How often cloud-only accounts on each domain must change their password. Microsoft and the NCSC now advise against regular expiry when everyone has MFA: forced changes lead to weaker, predictable passwords. Accounts synced from on-premises AD follow AD's policy instead.

Domain	Signs in with	Passwords expire after	Reminder before expiry	Recommended
fabrikam.example	Microsoft Entra ID	Never		Never, with MFA required for everyone
fabrikam.onmicrosoft.com	Microsoft Entra ID	Never		Never, with MFA required for everyone
parked.example low	Microsoft Entra ID	90 days	14 days	Never, with MFA required for everyone

Data from MFA registration (6 hours ago), Sign-in methods policy (6 hours ago), Users (6 hours ago), Admin roles (6 hours ago), Conditional Access (6 hours ago), Directory sync (6 hours ago).

Passwords and sign-in methods

Strongest method 4

Methods registered 5

Sign-in methods by person 53

Sign-in methods policy 1 of 12

Authentication strengths in Conditional Access 0

Password age 53

Password expiry policy 3