Contoso Legal LLP
Each enabled member counted once, by the strongest method they have.
| Strength | People | Admins | Share of members |
|---|---|---|---|
| Phishing-resistant | 4 | 0 | 21% |
| Authenticator app or token | 9 | 1 | 47% |
| Phone (SMS or voice call) medium | 3 | 0 | 16% |
| None medium | 3 | 1 | 16% |
How many enabled members have each method. People usually have more than one.
Enabled members and what they can sign in with, weakest first and admins at the top. Who hasn't set up MFA at all, and whether it's required, is in MFA coverage.
| Account | Admin | Admin roles | Strongest method | Methods | Asked for first | Passwordless | Self‑service reset |
|---|---|---|---|---|---|---|---|
| breakglass@contoso.example high | Yes | Global Administrator | None | No | No | ||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| annabel.fraser@ | Yes | Global Administrator, Groups Administrator (limited scope) | Authenticator app or token | Authenticator app | Authenticator app | No | Yes |
What to do: Admin without a phishing-resistant method: register a passkey or security key. | |||||||
| joseph.morris@contoso.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| lily.harrison@contoso.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| rhys.evans@contoso.example medium | No | Phone (SMS or voice call) | Mobile phone (SMS or call) | No | Unknown | ||
What to do: Only a phone: set up the Authenticator app (or a passkey), then keep the phone as a backup at most. | |||||||
| sophie.taylor@contoso.example medium | No | Phone (SMS or voice call) | Mobile phone (SMS or call) | No | Unknown | ||
What to do: Only a phone: set up the Authenticator app (or a passkey), then keep the phone as a backup at most. | |||||||
| william.allen@contoso.example medium | No | Phone (SMS or voice call) | Mobile phone (SMS or call) | No | Unknown | ||
What to do: Only a phone: set up the Authenticator app (or a passkey), then keep the phone as a backup at most. | |||||||
| evie.davis@contoso.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| jack.white@contoso.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| megan.smith@contoso.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| oliver.hill@contoso.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| olivia.ward@contoso.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| olivia.wilson@contoso.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| owen.taylor@contoso.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| william.clark@contoso.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| ella.thomas@contoso.example | No | Phishing-resistant | Windows Hello for Business, Authenticator app | No | Unknown | ||
| jacob.johnson@contoso.example | No | Phishing-resistant | Passkey, Authenticator app | No | Unknown | ||
| noah.clark@contoso.example | No | Phishing-resistant | Windows Hello for Business, Authenticator app | No | Unknown | ||
| priya.hughes@contoso.example | No | Phishing-resistant | Windows Hello for Business, Authenticator app | No | Unknown | ||
Which methods people may register and use, from the tenant's authentication methods policy, against what's recommended for a small business.
| Setting | Current | Recommended | Why |
|---|---|---|---|
| Methods managed in this policy (not the old MFA and SSPR settings) | Yes | Yes | Microsoft has retired the old per-user MFA and SSPR method settings. |
Authentication strengths in Conditional Access 0
No Conditional Access policy requires an authentication strength. Start with one requiring Phishing-resistant MFA for admin roles, once admins have a passkey.
When each enabled member's password was last set. An old password matters most without MFA; an account that has never signed in may still have the password it was created with. Problems first, then oldest first.
How often cloud-only accounts on each domain must change their password. Microsoft and the NCSC now advise against regular expiry when everyone has MFA: forced changes lead to weaker, predictable passwords. Accounts synced from on-premises AD follow AD's policy instead.
| Domain | Signs in with | Passwords expire after | Reminder before expiry | Recommended |
|---|---|---|---|---|
| contoso.example | Microsoft Entra ID | Never | Never, with MFA required for everyone | |
| contoso.onmicrosoft.com | Microsoft Entra ID | Never | Never, with MFA required for everyone | |
| parked.example low | Microsoft Entra ID | 90 days | 14 days | Never, with MFA required for everyone |
Data from MFA registration (), Sign-in methods policy (), Users (), Admin roles (), Conditional Access (), Directory sync ().