Harbour ITMenu

Powered by Office Sentry 2.3.1

You're in the demo. Three fictional clients with made-up people. Look around freely: nothing can be changed, and it all resets every night.Get Office Sentry
Clients/Fabrikam Dental Group

Fabrikam Dental Group

fabrikam.onmicrosoft.com
Monthly review

Conditional Access coverage

Every policy in plain words, and which accounts each one actually covers.

All clients
Download PDFXLSX
Policies 11Coverage by account 55

Policies 11

2 to review CSV

Every policy in plain words, enforced ones first.

PolicyStateApplies toExceptAppsConditionsRequires
CA001 — Admins: Require phishing-resistant MFAOn
11 admin roles
  • Global Administrator
  • Security Administrator
  • SharePoint Administrator
  • Exchange Administrator
  • Conditional Access Administrator
  • Application Administrator
  • Cloud Application Administrator
  • Password Administrator
  • Privileged Authentication Administrator
  • Privileged Role Administrator
  • User Administrator
breakglass@fabrikam.exampleAll appsMFA
CA002 — All users: Require MFAOnAll users
breakglass@fabrikam.example + 11 admin roles
  • breakglass@fabrikam.example
  • Global Administrator
  • Security Administrator
  • SharePoint Administrator
  • Exchange Administrator
  • Conditional Access Administrator
  • Application Administrator
  • Cloud Application Administrator
  • Password Administrator
  • Privileged Authentication Administrator
  • Privileged Role Administrator
  • User Administrator
All appsMFA
CA005 — Block sign-ins from disallowed countriesOnAll usersbreakglass@fabrikam.exampleAll appsLocationsBlock
CA006 — Require MFA for Azure managementOnAll usersbreakglass@fabrikam.example1 appMFA
CA007 — Admins: No persistent browser, 8h sign-in frequencyOn
11 admin roles
  • Global Administrator
  • Security Administrator
  • SharePoint Administrator
  • Exchange Administrator
  • Conditional Access Administrator
  • Application Administrator
  • Cloud Application Administrator
  • Password Administrator
  • Privileged Authentication Administrator
  • Privileged Role Administrator
  • User Administrator
breakglass@fabrikam.exampleAll appsSession controls
CA008 — All users: 8h sign-in frequencyOnAll users
breakglass@fabrikam.example + 11 admin roles
  • breakglass@fabrikam.example
  • Global Administrator
  • Security Administrator
  • SharePoint Administrator
  • Exchange Administrator
  • Conditional Access Administrator
  • Application Administrator
  • Cloud Application Administrator
  • Password Administrator
  • Privileged Authentication Administrator
  • Privileged Role Administrator
  • User Administrator
All appsSession controls
CA009 — Require MFA for device registrationOnAll usersbreakglass@fabrikam.exampleUser actionsMFA
CA010 — Insider risk: Step-up MFA mediumOn, but never applies (needs Entra ID P2)All usersbreakglass@fabrikam.exampleAll appsUser risk: highMFA
CA011 — High sign-in risk: Block mediumOn, but never applies (needs Entra ID P2)All usersbreakglass@fabrikam.exampleAll appsSign-in risk: highBlock
CA003 — Block legacy authenticationReport-onlyAll usersbreakglass@fabrikam.exampleAll appsClients: ActiveSync, Other legacyBlock
CA004 — All users: Require compliant or hybrid-joined deviceReport-onlyAll usersbreakglass@fabrikam.example, anna.kowalski@fabrikam.exampleAll appsPlatforms: windows, macOSCompliant device or Hybrid joined

Coverage by account 55

1 to review CSV

54 of 55 enabled accounts are covered by an enforced policy that requires MFA for all apps.

AccountTypeAdmin rolesMFA required byExcluded from
breakglass@fabrikam.example highMemberGlobal AdministratorNothing
CA001 — Admins: Require phishing-resistant MFA, CA002 — All users: Require MFA + 7 more
  • CA001 — Admins: Require phishing-resistant MFA
  • CA002 — All users: Require MFA
  • CA005 — Block sign-ins from disallowed countries
  • CA006 — Require MFA for Azure management
  • CA007 — Admins: No persistent browser, 8h sign-in frequency
  • CA008 — All users: 8h sign-in frequency
  • CA009 — Require MFA for device registration
  • CA010 — Insider risk: Step-up MFA
  • CA011 — High sign-in risk: Block
anna.kowalski@fabrikam.exampleMemberGlobal AdministratorCA001 — Admins: Require phishing-resistant MFACA002 — All users: Require MFA, CA008 — All users: 8h sign-in frequency
g#EXT#@fabrikam.exampleGuestExchange AdministratorCA001 — Admins: Require phishing-resistant MFACA002 — All users: Require MFA, CA008 — All users: 8h sign-in frequency
aaron.smith@fabrikam.exampleMemberCA002 — All users: Require MFA
aisha.brown@fabrikam.exampleMemberCA002 — All users: Require MFA
amelia.jackson@fabrikam.exampleMemberCA002 — All users: Require MFA
amelia.khan@fabrikam.exampleMemberCA002 — All users: Require MFA
arthur.lee@fabrikam.exampleMemberCA002 — All users: Require MFA
arthur.williams@fabrikam.exampleMemberCA002 — All users: Require MFA
ava.jackson@fabrikam.exampleMemberCA002 — All users: Require MFA
ava.moore@fabrikam.exampleMemberCA002 — All users: Require MFA
ava.thomas@fabrikam.exampleMemberCA002 — All users: Require MFA
callum.turner@fabrikam.exampleMemberCA002 — All users: Require MFA
chloe.jackson@fabrikam.exampleMemberCA002 — All users: Require MFA
ella.evans@fabrikam.exampleMemberCA002 — All users: Require MFA
ella.hughes@fabrikam.exampleMemberCA002 — All users: Require MFA
ethan.jones@fabrikam.exampleMemberCA002 — All users: Require MFA
freya.evans@fabrikam.exampleMemberCA002 — All users: Require MFA
george.baker@fabrikam.exampleMemberCA002 — All users: Require MFA
george.walker@fabrikam.exampleMemberCA002 — All users: Require MFA
george.williams@fabrikam.exampleMemberCA002 — All users: Require MFA
henry.roberts@fabrikam.exampleMemberCA002 — All users: Require MFA
isla.scott@fabrikam.exampleMemberCA002 — All users: Require MFA
jack.lee@fabrikam.exampleMemberCA002 — All users: Require MFA
jack.roberts@fabrikam.exampleMemberCA002 — All users: Require MFA
jack.ward@fabrikam.exampleMemberCA002 — All users: Require MFA
leo.harrison@fabrikam.exampleMemberCA002 — All users: Require MFA
lily.khan@fabrikam.exampleMemberCA002 — All users: Require MFA
lily.watson@fabrikam.exampleMemberCA002 — All users: Require MFA
lily.white@fabrikam.exampleMemberCA002 — All users: Require MFA
megan.green@fabrikam.exampleMemberCA002 — All users: Require MFA
megan.king@fabrikam.exampleMemberCA002 — All users: Require MFA
noah.harris@fabrikam.exampleMemberCA002 — All users: Require MFA
noah.wood@fabrikam.exampleMemberCA002 — All users: Require MFA
olivia.taylor@fabrikam.exampleMemberCA002 — All users: Require MFA
oscar.smith@fabrikam.exampleMemberCA002 — All users: Require MFA
owen.khan@fabrikam.exampleMemberCA002 — All users: Require MFA
owen.patel@fabrikam.exampleMemberCA002 — All users: Require MFA
owen.robinson@fabrikam.exampleMemberCA002 — All users: Require MFA
owen.scott@fabrikam.exampleMemberCA002 — All users: Require MFA
owen.smith@fabrikam.exampleMemberCA002 — All users: Require MFA
owen.turner@fabrikam.exampleMemberCA002 — All users: Require MFA
priya.williams@fabrikam.exampleMemberCA002 — All users: Require MFA
rhys.hall@fabrikam.exampleMemberCA002 — All users: Require MFA
rhys.scott@fabrikam.exampleMemberCA002 — All users: Require MFA
rhys.walker@fabrikam.exampleMemberCA002 — All users: Require MFA
ruby.clark@fabrikam.exampleMemberCA002 — All users: Require MFA
ruby.davies@fabrikam.exampleMemberCA002 — All users: Require MFA
ruby.wood@fabrikam.exampleMemberCA002 — All users: Require MFA
thomas.allen@fabrikam.exampleMemberCA002 — All users: Require MFA
thomas.johnson@fabrikam.exampleMemberCA002 — All users: Require MFA
thomas.robinson@fabrikam.exampleMemberCA002 — All users: Require MFA
william.lewis@fabrikam.exampleMemberCA002 — All users: Require MFA
william.wood@fabrikam.exampleMemberCA002 — All users: Require MFA
zara.edwards@fabrikam.exampleMemberCA002 — All users: Require MFA

Data from Conditional Access (), Admin roles (), Users ().