Harbour ITMenu

Powered by Office Sentry 2.3.0

You're in the demo. Three fictional clients with made-up people. Look around freely: nothing can be changed, and it all resets every night.Get Office Sentry
Clients/Contoso Legal LLP

Contoso Legal LLP

contoso.onmicrosoft.com
Monthly review

Admins and roles

Every admin role holder with MFA, PIM and sign-in status, and a break-glass check.

All clients
Download PDFXLSX
Privileged accounts
3
People with a permanent admin role
Global Administrators
2Since 20 Jul 2026: from 2 to 2
Keep between 2 and 4
Admins without MFA
1
Not set up at all
Break-glass accounts
1
Emergency accounts kept out of Conditional Access
Using PIM
Not checked
Needs Entra ID P2
Not checked

PIM (admins activating a role only when they need it) needs Entra ID P2, which this tenant doesn't have, so every role shown is permanent.

Privileged role holders 5Break-glass accounts 1Other roles 1

Privileged role holders 5

3 to review CSV

Everyone who holds a role that can change security settings, users or data. Problems first.

By role
  1. Exchange Administrator2
  2. Global Administrator2
  3. Global Administrator (eligible)1
  4. Groups Administrator (limited scope)1
AccountKindRolesHow assignedMFA set upMFA required byLast sign‑inSynced from on‑premises
breakglass@contoso.example criticalUserGlobal AdministratorPermanentNoNothing30 Sep 2026No
g#EXT#@contoso.example highGuestExchange AdministratorPermanentUnknownCA001 — Admins: Require phishing-resistant MFANeverNo
Some app mediumAppExchange AdministratorPermanent
annabel.fraser@contoso.exampleUserGlobal Administrator, Groups Administrator (limited scope)PermanentYesCA001 — Admins: Require phishing-resistant MFA30 Sep 2026No
eve.lambert@contoso.exampleUserGlobal Administrator (eligible)Eligible (PIM)UnknownCA002 — All users: Require MFANot checkedUnknown

Break-glass accounts 1

1 to review CSV

Emergency Global Administrator accounts for when normal sign-in breaks. Microsoft recommends two, cloud-only, excluded from Conditional Access, signing in with a FIDO2 key or passkey kept somewhere safe.

AccountCloud‑onlyOn the .onmicrosoft.com domainExcluded fromSign‑in methodsLast sign‑in
breakglass@contoso.example highYesNoCA001 — Admins: Require phishing-resistant MFA, CA002 — All users: Require MFA, CA003 — Block legacy authentication and 8 moreNone30 Sep 2026
Why we think it's break-glass: Named like one, Excluded from Conditional AccessWhat to check: No MFA method: Microsoft requires MFA for admin portals, so it may not get in; Use the .onmicrosoft.com domain so it works if a custom domain breaks

Other roles 1

CSV

Roles with narrower or read-only permissions.

AccountKindRolesHow assigned
bobby.marsh@contoso.exampleUserDirectory Readers, Groups Administrator (limited scope)Permanent

Data from Admin roles (), Users (), MFA registration (), Conditional Access ().