Clients/Contoso Legal LLP

Contoso Legal LLP

contoso.onmicrosoft.com

Report

Every policy in plain words, enforced ones first.

Policy	State	Applies to	Except	Apps	Requires
CA001 — Admins: Require phishing-resistant MFA	On	11 admin roles Global Administrator Security Administrator SharePoint Administrator Exchange Administrator Conditional Access Administrator Application Administrator Cloud Application Administrator Password Administrator Privileged Authentication Administrator Privileged Role Administrator User Administrator	breakglass@contoso.example	All apps	MFA
CA002 — All users: Require MFA	On	All users	breakglass@contoso.example + 11 admin roles breakglass@contoso.example Global Administrator Security Administrator SharePoint Administrator Exchange Administrator Conditional Access Administrator Application Administrator Cloud Application Administrator Password Administrator Privileged Authentication Administrator Privileged Role Administrator User Administrator	All apps	MFA
CA003 — Block legacy authentication	On	All users	breakglass@contoso.example	All apps	Block
CA004 — All users: Require compliant or hybrid-joined device	On	All users	breakglass@contoso.example, annabel.fraser@contoso.example	All apps	Compliant device or Hybrid joined
CA005 — Block sign-ins from disallowed countries	On	All users	breakglass@contoso.example	All apps	Block
CA006 — Require MFA for Azure management	On	All users	breakglass@contoso.example	1 app	MFA
CA007 — Admins: No persistent browser, 8h sign-in frequency	On	11 admin roles Global Administrator Security Administrator SharePoint Administrator Exchange Administrator Conditional Access Administrator Application Administrator Cloud Application Administrator Password Administrator Privileged Authentication Administrator Privileged Role Administrator User Administrator	breakglass@contoso.example	All apps	Session controls
CA008 — All users: 8h sign-in frequency	On	All users	breakglass@contoso.example + 11 admin roles breakglass@contoso.example Global Administrator Security Administrator SharePoint Administrator Exchange Administrator Conditional Access Administrator Application Administrator Cloud Application Administrator Password Administrator Privileged Authentication Administrator Privileged Role Administrator User Administrator	All apps	Session controls
CA009 — Require MFA for device registration	On	All users	breakglass@contoso.example	User actions	MFA
CA010 — Insider risk: Step-up MFA medium	On, but never applies (needs Entra ID P2)	All users	breakglass@contoso.example	All apps	MFA
CA011 — High sign-in risk: Block medium	On, but never applies (needs Entra ID P2)	All users	breakglass@contoso.example	All apps	Block

19 of 20 enabled accounts are covered by an enforced policy that requires MFA for all apps.

Admin roles: Blank Clear filters

Account	Type	MFA required by	Legacy sign‑in blocked
ella.thomas@contoso.example	Member	CA002 — All users: Require MFA	Yes
evie.davis@contoso.example	Member	CA002 — All users: Require MFA	Yes
jack.white@contoso.example	Member	CA002 — All users: Require MFA	Yes
jacob.johnson@contoso.example	Member	CA002 — All users: Require MFA	Yes
joseph.morris@contoso.example	Member	CA002 — All users: Require MFA	Yes
lily.harrison@contoso.example	Member	CA002 — All users: Require MFA	Yes
megan.smith@contoso.example	Member	CA002 — All users: Require MFA	Yes
noah.clark@contoso.example	Member	CA002 — All users: Require MFA	Yes
oliver.hill@contoso.example	Member	CA002 — All users: Require MFA	Yes
olivia.ward@contoso.example	Member	CA002 — All users: Require MFA	Yes
olivia.wilson@contoso.example	Member	CA002 — All users: Require MFA	Yes
owen.taylor@contoso.example	Member	CA002 — All users: Require MFA	Yes
priya.hughes@contoso.example	Member	CA002 — All users: Require MFA	Yes
rhys.evans@contoso.example	Member	CA002 — All users: Require MFA	Yes
sophie.taylor@contoso.example	Member	CA002 — All users: Require MFA	Yes
william.allen@contoso.example	Member	CA002 — All users: Require MFA	Yes
william.clark@contoso.example	Member	CA002 — All users: Require MFA	Yes

Data from Conditional Access (11 minutes ago), Admin roles (11 minutes ago), Users (11 minutes ago).

Conditional Access coverage

Policies 11

Coverage by account 17 of 20