Contoso Legal LLP
Each enabled member counted once, by the strongest method they have.
| Strength | People | Admins | Share of members | What it means |
|---|---|---|---|---|
| Phishing-resistant | 4 | 0 | 22% | Bound to the real Microsoft sign-in page, so a fake page can't relay it. |
| Authenticator app or token | 9 | 1 | 50% | Strong, but a convincing fake sign-in page can relay a code or push approval. |
| Phone (SMS or voice call) medium | 3 | 0 | 17% | Weakest second factor: texts and calls can be intercepted or moved to another SIM. |
| None medium | 2 | 0 | 11% | No second factor: the password alone gets in. |
How many enabled members have each method. People usually have more than one.
Enabled members and what they can sign in with, weakest first and admins at the top. Who hasn't set up MFA at all, and whether it's required, is in MFA coverage.
| Account | Admin | Admin roles | Strongest method | Methods | Asked for first | Passwordless | Self-service reset |
|---|---|---|---|---|---|---|---|
| annabel.fraser@contoso.example medium | Yes | Global Administrator, Groups Administrator (limited scope) | Authenticator app or token | Authenticator app | Authenticator app | No | Yes |
What to do: Admin without a phishing-resistant method: register a passkey or security key. | |||||||
| joseph.morris@contoso.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| lily.harrison@contoso.example medium | No | None | No | Unknown | |||
What to do: No second factor. Set up MFA first (see MFA coverage). | |||||||
| rhys.evans@contoso.example medium | No | Phone (SMS or voice call) | Mobile phone (SMS or call) | No | Unknown | ||
What to do: Only a phone: set up the Authenticator app (or a passkey), then keep the phone as a backup at most. | |||||||
| sophie.taylor@contoso.example medium | No | Phone (SMS or voice call) | Mobile phone (SMS or call) | No | Unknown | ||
What to do: Only a phone: set up the Authenticator app (or a passkey), then keep the phone as a backup at most. | |||||||
| william.allen@contoso.example medium | No | Phone (SMS or voice call) | Mobile phone (SMS or call) | No | Unknown | ||
What to do: Only a phone: set up the Authenticator app (or a passkey), then keep the phone as a backup at most. | |||||||
| evie.davis@contoso.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| jack.white@contoso.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| megan.smith@contoso.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| oliver.hill@contoso.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| olivia.ward@contoso.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| olivia.wilson@contoso.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| owen.taylor@contoso.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| william.clark@contoso.example | No | Authenticator app or token | Authenticator app, Authenticator code (OATH) | No | Unknown | ||
| ella.thomas@contoso.example | No | Phishing-resistant | Windows Hello for Business, Authenticator app | No | Unknown | ||
| jacob.johnson@contoso.example | No | Phishing-resistant | Passkey, Authenticator app | No | Unknown | ||
| noah.clark@contoso.example | No | Phishing-resistant | Windows Hello for Business, Authenticator app | No | Unknown | ||
| priya.hughes@contoso.example | No | Phishing-resistant | Windows Hello for Business, Authenticator app | No | Unknown | ||
Which methods people may register and use, from the tenant's authentication methods policy, against what's recommended for a small business.
| Setting | Current | Recommended | Why |
|---|---|---|---|
| Text message (SMS) low | On for All users except Break glass | Off, once people use Authenticator | Texts can be intercepted or moved to another SIM. |
Authentication strengths in Conditional Access 0
No Conditional Access policy requires an authentication strength. Start with one requiring Phishing-resistant MFA for admin roles, once admins have a passkey.
When each enabled member's password was last set. An old password matters most without MFA; an account that has never signed in may still have the password it was created with. Problems first, then oldest first.
How often cloud-only accounts on each domain must change their password. Microsoft and the NCSC now advise against regular expiry when everyone has MFA: forced changes lead to weaker, predictable passwords. Accounts synced from on-premises AD follow AD's policy instead.
| Domain | Signs in with | Passwords expire after | Reminder before expiry | Recommended |
|---|---|---|---|---|
| contoso.example | Microsoft Entra ID | Never | Never, with MFA required for everyone | |
| contoso.onmicrosoft.com | Microsoft Entra ID | Never | Never, with MFA required for everyone | |
| parked.example low | Microsoft Entra ID | 90 days | 14 days | Never, with MFA required for everyone |
Data from MFA registration (), Sign-in methods policy (), Users (), Admin roles (), Conditional Access (), Directory sync ().