Fabrikam Dental Group
fabrikam.onmicrosoft.com
Each row is an account or setting a check flagged. Findings close on their own once the next collection no longer sees the problem. If something is intentional, accept the risk so it moves out of the totals.
Open findings
163
from 46 checks
Critical or high
31
fix these first
New in 30 days
17
first seen since 15 Sep
Open over 90 days
0
Accepted risks
0
left out of the totals
| Severity | Account or item | Detail | Category | Action |
|---|---|---|---|---|
| critical | breakglass@fabrikam.example | Global Administrator with no MFA method registered | Admins |
Accept risk |
| low | g#EXT#@fabrikam.example | Exchange Administrator: MFA registration unknown | Admins |
Accept risk |
| high | breakglass@fabrikam.example | Global Administrator: excluded from CA001 — Admins: Require phishing-resistant MFA, CA002 — All users: Require MFA, CA005 — Block sign-ins from disallowed countries, CA006 — Require MFA for Azure management, CA007 — Admins: No persistent browser, 8h sign-in frequency, CA008 — All users: 8h sign-in frequency, CA009 — Require MFA for device registration, CA010 — Insider risk: Step-up MFA, CA011 — High sign-in risk: Block | Admins |
Accept risk |
| high | DESK-MOORE18 (ava.moore@fabrikam.example) | Windows disk isn't encrypted | Devices |
Accept risk |
| high | DESK-ROBINSON51 (owen.robinson@ | Windows disk isn't encrypted | Devices |
Accept risk |
| high | LAPTOP-OKAFOR (ben.okafor@fabrikam.example) | Windows disk isn't encrypted | Devices |
Accept risk |
| high | LAPTOP-ROBINSON07 (thomas.robinson@ | Windows disk isn't encrypted | Devices |
Accept risk |
| high | LAPTOP-WARD29 (jack.ward@fabrikam.example) | Windows disk isn't encrypted | Devices |
Accept risk |
| high | LAPTOP-WATSON40 (lily.watson@ | Windows disk isn't encrypted | Devices |
Accept risk |
| high | fabrikam.example | Set domain authentication by mallory.quinn@ | Identity |
Accept risk |
| high | anna.kowalski@ | Mailbox forwarding to anna.kowalski@ |
Accept risk |
|
| high | anna.kowalski@ | Inbox rule "Copy to home" forwards to anna.kowalski.home@ |
Accept risk |
|
| high | rhys.hall@fabrikam.example | Mailbox forwarding to rhys.hall@homemail.example (doesn't keep a copy) |
Accept risk |
|
| high | rhys.walker@fabrikam.example | Mailbox forwarding to rhys.walker@homemail.example (doesn't keep a copy) |
Accept risk |
|
| high | thomas.robinson@ | Inbox rule "Invoices to bookkeeper" forwards to bookkeeping@ |
Accept risk |
|
| high | g#EXT#@fabrikam.example | Guest holding Exchange Administrator | Admins |
Accept risk |
| high | Tenant | No enabled policy blocks legacy authentication for all users | Identity |
Accept risk |
| high | Copy patient letters to archive | Sends mail or copies to records@dentalarchive.example |
Accept risk |
|
| high | Mail Sync Pro | Mail.Read (application permission; unverified publisher) | Apps |
Accept risk |
| high | accounts@ | Full Control, given Full Control directly | Sharing |
Accept risk |
| high | Marketing | No enabled owner (Microsoft 365 group) | Sharing |
Accept risk |
| high | Old Projects | No enabled owner (site administrators and owners group) | Sharing |
Accept risk |
| low | Practice Management | One owner (Microsoft 365 group) | Sharing |
Accept risk |
| low | Staff Intranet | One owner (site administrators and owners group) | Sharing |
Accept risk |
| high | Default | Allows mail claiming to be from gmail.com, labpartners.example past the spam filter (gmail.com is free mail or the organisation's own) |
Accept risk |
|
| high | LAPTOP-HARRIS31 (noah.harris@ | Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. | Devices |
Accept risk |
| high | LAPTOP-JACKSON49 (chloe.jackson@ | Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. | Devices |
Accept risk |
| high | LAPTOP-OKAFOR (ben.okafor@fabrikam.example) | Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. | Devices |
Accept risk |
| high | LAPTOP-SMITH13 (owen.smith@fabrikam.example) | Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. | Devices |
Accept risk |
| high | LAPTOP-WALKER04 (rhys.walker@ | Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. | Devices |
Accept risk |
| high | LAPTOP-WATSON40 (lily.watson@ | Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. | Devices |
Accept risk |
| high | LAPTOP-WOOD22 (william.wood@ | Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. | Devices |
Accept risk |
| medium | DESK-ALLEN09 (thomas.allen@ | Windows 11 24H2: updates for Home and Pro ended 13 Oct 2026 (Enterprise and Education: 12 Oct 2027). | Devices |
Accept risk |
| medium | DESK-CLARK06 (ruby.clark@fabrikam.example) | Windows 11 24H2: updates for Home and Pro ended 13 Oct 2026 (Enterprise and Education: 12 Oct 2027). | Devices |
Accept risk |
| medium | DESK-HARRISON21 (leo.harrison@ | Windows 11 24H2: updates for Home and Pro ended 13 Oct 2026 (Enterprise and Education: 12 Oct 2027). | Devices |
Accept risk |
| medium | DESK-KHAN30 (owen.khan@fabrikam.example) | Windows 11 24H2: updates for Home and Pro ended 13 Oct 2026 (Enterprise and Education: 12 Oct 2027). | Devices |
Accept risk |
| medium | DESK-KING24 (megan.king@fabrikam.example) | Windows 11 24H2: updates for Home and Pro ended 13 Oct 2026 (Enterprise and Education: 12 Oct 2027). | Devices |
Accept risk |
| medium | DESK-MOORE18 (ava.moore@fabrikam.example) | Windows 11 24H2: updates for Home and Pro ended 13 Oct 2026 (Enterprise and Education: 12 Oct 2027). | Devices |
Accept risk |
| medium | DESK-ROBERTS45 (jack.roberts@ | Windows 11 24H2: updates for Home and Pro ended 13 Oct 2026 (Enterprise and Education: 12 Oct 2027). | Devices |
Accept risk |
| medium | DESK-ROBINSON51 (owen.robinson@ | Windows 11 24H2: updates for Home and Pro ended 13 Oct 2026 (Enterprise and Education: 12 Oct 2027). | Devices |
Accept risk |
| medium | DESK-WHITE42 (lily.white@fabrikam.example) | Windows 11 24H2: updates for Home and Pro ended 13 Oct 2026 (Enterprise and Education: 12 Oct 2027). | Devices |
Accept risk |
| medium | DESK-WILLIAMS27 (arthur.williams@ | Windows 11 24H2: updates for Home and Pro ended 13 Oct 2026 (Enterprise and Education: 12 Oct 2027). | Devices |
Accept risk |
| medium | DESK-WOOD39 (ruby.wood@fabrikam.example) | Windows 11 24H2: updates for Home and Pro ended 13 Oct 2026 (Enterprise and Education: 12 Oct 2027). | Devices |
Accept risk |
| medium | LAPTOP-BROWN01 (aisha.brown@ | Windows 11 24H2: updates for Home and Pro ended 13 Oct 2026 (Enterprise and Education: 12 Oct 2027). | Devices |
Accept risk |
| medium | LAPTOP-DAVIES38 (ruby.davies@ | Windows 11 24H2: updates for Home and Pro ended 13 Oct 2026 (Enterprise and Education: 12 Oct 2027). | Devices |
Accept risk |
| medium | LAPTOP-GREEN32 (megan.green@ | Windows 11 24H2: updates for Home and Pro ended 13 Oct 2026 (Enterprise and Education: 12 Oct 2027). | Devices |
Accept risk |
| medium | LAPTOP-JOHNSON47 (thomas.johnson@ | Windows 11 24H2: updates for Home and Pro ended 13 Oct 2026 (Enterprise and Education: 12 Oct 2027). | Devices |
Accept risk |
| medium | LAPTOP-JONES34 (ethan.jones@ | Windows 11 24H2: updates for Home and Pro ended 13 Oct 2026 (Enterprise and Education: 12 Oct 2027). | Devices |
Accept risk |
| medium | LAPTOP-KHAN35 (lily.khan@fabrikam.example) | Windows 11 24H2: updates for Home and Pro ended 13 Oct 2026 (Enterprise and Education: 12 Oct 2027). | Devices |
Accept risk |
| medium | LAPTOP-LEE02 (jack.lee@fabrikam.example) | Windows 11 24H2: updates for Home and Pro ended 13 Oct 2026 (Enterprise and Education: 12 Oct 2027). | Devices |
Accept risk |
| medium | LAPTOP-LEE25 (arthur.lee@fabrikam.example) | Windows 11 24H2: updates for Home and Pro ended 13 Oct 2026 (Enterprise and Education: 12 Oct 2027). | Devices |
Accept risk |
| medium | LAPTOP-ROBERTS41 (henry.roberts@ | Windows 11 24H2: updates for Home and Pro ended 13 Oct 2026 (Enterprise and Education: 12 Oct 2027). | Devices |
Accept risk |
| medium | LAPTOP-SCOTT17 (owen.scott@fabrikam.example) | Windows 11 24H2: updates for Home and Pro ended 13 Oct 2026 (Enterprise and Education: 12 Oct 2027). | Devices |
Accept risk |
| medium | LAPTOP-SCOTT19 (isla.scott@fabrikam.example) | Windows 11 24H2: updates for Home and Pro ended 13 Oct 2026 (Enterprise and Education: 12 Oct 2027). | Devices |
Accept risk |
| medium | LAPTOP-SMITH50 (oscar.smith@ | Windows 11 24H2: updates for Home and Pro ended 13 Oct 2026 (Enterprise and Education: 12 Oct 2027). | Devices |
Accept risk |
| medium | LAPTOP-TAYLOR43 (olivia.taylor@ | Windows 11 24H2: updates for Home and Pro ended 13 Oct 2026 (Enterprise and Education: 12 Oct 2027). | Devices |
Accept risk |
| medium | LAPTOP-THOMAS08 (ava.thomas@fabrikam.example) | Windows 11 24H2: updates for Home and Pro ended 13 Oct 2026 (Enterprise and Education: 12 Oct 2027). | Devices |
Accept risk |
| medium | LAPTOP-TURNER37 (callum.turner@ | Windows 11 24H2: updates for Home and Pro ended 13 Oct 2026 (Enterprise and Education: 12 Oct 2027). | Devices |
Accept risk |
| medium | LAPTOP-WALKER10 (george.walker@ | Windows 11 24H2: updates for Home and Pro ended 13 Oct 2026 (Enterprise and Education: 12 Oct 2027). | Devices |
Accept risk |
| medium | LAPTOP-WARD29 (jack.ward@fabrikam.example) | Windows 11 24H2: updates for Home and Pro ended 13 Oct 2026 (Enterprise and Education: 12 Oct 2027). | Devices |
Accept risk |
| medium | LAPTOP-WILLIAMS20 (priya.williams@ | Windows 11 24H2: updates for Home and Pro ended 13 Oct 2026 (Enterprise and Education: 12 Oct 2027). | Devices |
Accept risk |
| high | anna.kowalski@ | ".": Moves to RSS Feeds mail mentioning invoice, payment; Rule name '.' looks deliberately blank |
Accept risk |
|
| high | breakglass@fabrikam.example | No MFA method registered | Identity |
Accept risk |
| medium | aaron.smith@fabrikam.example | No MFA method registered | Identity |
Accept risk |
| medium | aisha.brown@fabrikam.example | No MFA method registered | Identity |
Accept risk |
| medium | amelia.khan@fabrikam.example | No MFA method registered | Identity |
Accept risk |
| medium | arthur.williams@ | No MFA method registered | Identity |
Accept risk |
| medium | ava.jackson@fabrikam.example | No MFA method registered | Identity |
Accept risk |
| medium | ava.moore@fabrikam.example | No MFA method registered | Identity |
Accept risk |
| medium | ava.thomas@fabrikam.example | No MFA method registered | Identity |
Accept risk |
| medium | carl.svensson@ | No MFA method registered | Identity |
Accept risk |
| medium | chloe.jackson@ | No MFA method registered | Identity |
Accept risk |
| medium | george.williams@ | No MFA method registered | Identity |
Accept risk |
| medium | henry.roberts@ | No MFA method registered | Identity |
Accept risk |
| medium | isla.scott@fabrikam.example | No MFA method registered | Identity |
Accept risk |
| medium | jack.lee@fabrikam.example | No MFA method registered | Identity |
Accept risk |
| medium | jack.roberts@fabrikam.example | No MFA method registered | Identity |
Accept risk |
| medium | lily.khan@fabrikam.example | No MFA method registered | Identity |
Accept risk |
| medium | lily.watson@fabrikam.example | No MFA method registered | Identity |
Accept risk |
| medium | lily.white@fabrikam.example | No MFA method registered | Identity |
Accept risk |
| medium | megan.king@fabrikam.example | No MFA method registered | Identity |
Accept risk |
| medium | noah.wood@fabrikam.example | No MFA method registered | Identity |
Accept risk |
| medium | olivia.taylor@ | No MFA method registered | Identity |
Accept risk |
| medium | owen.scott@fabrikam.example | No MFA method registered | Identity |
Accept risk |
| medium | rhys.walker@fabrikam.example | No MFA method registered | Identity |
Accept risk |
| medium | ruby.davies@fabrikam.example | No MFA method registered | Identity |
Accept risk |
| medium | ruby.wood@fabrikam.example | No MFA method registered | Identity |
Accept risk |
| medium | thomas.johnson@ | No MFA method registered | Identity |
Accept risk |
| medium | zara.edwards@fabrikam.example | No MFA method registered | Identity |
Accept risk |
| medium | anna.kowalski@ | Global Administrator; signs in with Authenticator app | Admins |
Accept risk |
| medium | breakglass@fabrikam.example | Global Administrator; signs in with no MFA method at all | Admins |
Accept risk |
| medium | holiday.jpg (OneDrive of anna.kowalski@ | Anyone can view | Sharing |
Accept risk |
| medium | Open day flyer.pdf (Marketing / Documents) | Anyone can view, link never expires | Sharing |
Accept risk |
| medium | DESK-SMITH03 | Encrypted, but no recovery key saved in Entra ID | Devices |
Accept risk |
| medium | DESK-WHITE42 | Encrypted, but no recovery key saved in Entra ID | Devices |
Accept risk |
| medium | LAPTOP-EVANS26 | Encrypted, but no recovery key saved in Entra ID | Devices |
Accept risk |
| medium | LAPTOP-HUGHES11 | Encrypted, but no recovery key saved in Entra ID | Devices |
Accept risk |
| medium | LAPTOP-JACKSON49 | Encrypted, but no recovery key saved in Entra ID | Devices |
Accept risk |
| medium | LAPTOP-JONES34 | Encrypted, but no recovery key saved in Entra ID | Devices |
Accept risk |
| medium | LAPTOP-SCOTT19 | Encrypted, but no recovery key saved in Entra ID | Devices |
Accept risk |
| low | DESK-RECEPTION | No recovery key saved in Entra ID (encryption not known) | Devices |
Accept risk |
| medium | DESK-LEWIS12 (william.lewis@ | Not compliant | Devices |
Accept risk |
| medium | DESK-MOORE18 (ava.moore@fabrikam.example) | Not compliant | Devices |
Accept risk |
| medium | DESK-ROBINSON51 (owen.robinson@ | Not compliant | Devices |
Accept risk |
| medium | LAPTOP-DAVIES38 (ruby.davies@ | Not compliant | Devices |
Accept risk |
| medium | LAPTOP-LEE25 (arthur.lee@fabrikam.example) | Not compliant | Devices |
Accept risk |
| medium | LAPTOP-OKAFOR (ben.okafor@fabrikam.example) | Not compliant | Devices |
Accept risk |
| medium | LAPTOP-ROBINSON07 (thomas.robinson@ | Not compliant | Devices |
Accept risk |
| medium | LAPTOP-WARD29 (jack.ward@fabrikam.example) | Not compliant | Devices |
Accept risk |
| medium | LAPTOP-WATSON40 (lily.watson@ | Not compliant | Devices |
Accept risk |
| medium | fabrikam.example | Microsoft 365 DKIM isn't set up (selector2 CNAME missing) |
Accept risk |
|
| medium | fabrikam.example | DMARC is monitor-only (p=none); spoofed mail is still delivered |
Accept risk |
|
| low | parked.example | Doesn't receive mail but has no DMARC p=reject record |
Accept risk |
|
| medium | iOS/iPadOS | 1 enrolled device, no compliance policy assigned | Devices |
Accept risk |
| medium | ben.okafor@fabrikam.example | Disabled, holding 1 licence | Licences |
Accept risk |
| medium | accounts@fabrikam.example | 44.8 GB of 49.5 GB (91%), no archive | Storage |
Accept risk |
| medium | aisha.brown@fabrikam.example | 47.2 GB of 49.5 GB (95%), no archive | Storage |
Accept risk |
| medium | thomas.robinson@ | 45.6 GB of 49.5 GB (92%), no archive | Storage |
Accept risk |
| medium | Default | The common attachments filter is off |
Accept risk |
|
| medium | breakglass@fabrikam.example | Excluded from "CA002 — All users: Require MFA" | Identity |
Accept risk |
| medium | Budget.xlsx (Finance / Documents) | Can be edited by accountant@ | Sharing |
Accept risk |
| medium | Lab dockets (Patient Records / Documents) | Can be edited by orders@dentallab.example | Sharing |
Accept risk |
| medium | Project Phoenix | Team, only owner is disabled (Ben Okafor) | Groups |
Accept risk |
| low | Marketing | Microsoft 365 group, only owner is disabled (Ben Okafor) | Groups |
Accept risk |
| low | Marketing | Microsoft 365 group, no owner | Groups |
Accept risk |
| low | Provisioned | Microsoft 365 group, owned only by an app (Provisioning app) | Groups |
Accept risk |
| medium | Some app | App holding Exchange Administrator | Admins |
Accept risk |
| medium | SharePoint and OneDrive | Anyone links are allowed | Sharing |
Accept risk |
| medium | Tenant SharePoint storage | 88% of about 1.45 TB used (1 TB + 10 GB × 46 licences) | Storage |
Accept risk |
| low | https:/ | 117.5 GB, of which 3.0 GB in the recycle bin and 7.6 GB older versions | Storage |
Accept risk |
| low | https:/ | 483.2 GB, of which 46.0 GB in the recycle bin and 33.3 GB older versions | Storage |
Accept risk |
| low | https:/ | 65.3 GB, of which 1.0 GB in the recycle bin and 4.9 GB older versions | Storage |
Accept risk |
| low | https:/ | 352.6 GB, of which 12.0 GB in the recycle bin and 25.2 GB older versions | Storage |
Accept risk |
| low | https:/ | 182.8 GB, of which 6.0 GB in the recycle bin and 21.1 GB older versions | Storage |
Accept risk |
| medium | Office365 AntiPhish Default | Ignores what senders' DMARC policies ask for |
Accept risk |
|
| medium | aaron.smith@fabrikam.example | Licensed member, last signed in 25 Apr 2026 | Accounts |
Accept risk |
| medium | aisha.brown@fabrikam.example | Licensed member, last signed in 10 Mar 2026 | Accounts |
Accept risk |
| medium | jack.lee@fabrikam.example | Licensed member, last signed in 6 Jun 2026 | Accounts |
Accept risk |
| medium | noah.wood@fabrikam.example | Licensed member, last signed in 10 Feb 2026 | Accounts |
Accept risk |
| medium | rhys.walker@fabrikam.example | Licensed member, last signed in 8 Jun 2026 | Accounts |
Accept risk |
| medium | zara.edwards@fabrikam.example | Licensed member, last signed in 11 Jul 2026 | Accounts |
Accept risk |
| low | g#EXT#@fabrikam.example | Guest, never signed in, created ? | Accounts |
Accept risk |
| medium | Tenant | Any user can grant any app access to their mail and files | Apps |
Accept risk |
| low | Old connector | The 1 credential expired, last on 1 Jan 2025 | Apps |
Accept risk |
| low | Tenant | Users can register apps that nobody reviews | Tenant settings |
Accept risk |
| low | anna.kowalski@ | Reports to Ben Okafor, whose sign-in is blocked | Accounts |
Accept risk |
| low | DESK-LEWIS12 (william.lewis@ | Last check-in 38 days ago | Devices |
Accept risk |
| low | DESK-ROBINSON51 (owen.robinson@ | Last check-in 38 days ago | Devices |
Accept risk |
| low | LAPTOP-DAVIES38 (ruby.davies@ | Last check-in 38 days ago | Devices |
Accept risk |
| low | LAPTOP-LEE25 (arthur.lee@fabrikam.example) | Last check-in 38 days ago | Devices |
Accept risk |
| low | LAPTOP-OKAFOR (ben.okafor@fabrikam.example) | Last check-in 45 days ago | Devices |
Accept risk |
| low | Tenant | Guests can invite other guests | Guests |
Accept risk |
| low | DESK-RECEPTION | Hybrid joined, not managed by Intune | Devices |
Accept risk |
| low | fabrikam.example | No MTA-STS policy, so mail sent to this domain can be forced onto an unencrypted connection |
Accept risk |
|
| low | george.baker@fabrikam.example | Second factor is only Mobile phone (SMS or call) | Identity |
Accept risk |
| low | owen.robinson@ | Second factor is only Mobile phone (SMS or call) | Identity |
Accept risk |
| low | owen.turner@fabrikam.example | Second factor is only Mobile phone (SMS or call) | Identity |
Accept risk |
| low | thomas.allen@fabrikam.example | Second factor is only Mobile phone (SMS or call) | Identity |
Accept risk |
| low | Organisation | SMTP AUTH is allowed |
Accept risk |
|
| low | parked.example | Doesn't receive mail but has no "v=spf1 -all" record to stop spoofing |
Accept risk |
|
| low | OLD-PC | Windows, last seen 200 days ago | Devices |
Accept risk |
| low | Microsoft 365 Business Basic | 2 of 13 unassigned | Licences |
Accept risk |
| low | Microsoft 365 Business Premium | 3 of 46 unassigned | Licences |
Accept risk |
Accepted risks 0
No accepted risks. When something is intentional, accept the risk from its row above and it moves here with the reason.
Latest collection 15 Oct 2026, 04:00 UTC. Severity, check and first-seen filters, sorting and hidden columns stay in the address, so a saved view or a download shows the same rows.