Clients/Contoso Legal LLP

Contoso Legal LLP

contoso.onmicrosoft.com

Report

Every policy in plain words, enforced ones first.

State	Applies to	Except	Apps	Conditions	Requires
On	11 admin roles Global Administrator Security Administrator SharePoint Administrator Exchange Administrator Conditional Access Administrator Application Administrator Cloud Application Administrator Password Administrator Privileged Authentication Administrator Privileged Role Administrator User Administrator	breakglass@contoso.example	All apps		MFA
On	All users	breakglass@contoso.example + 11 admin roles breakglass@contoso.example Global Administrator Security Administrator SharePoint Administrator Exchange Administrator Conditional Access Administrator Application Administrator Cloud Application Administrator Password Administrator Privileged Authentication Administrator Privileged Role Administrator User Administrator	All apps		MFA
On	All users	breakglass@contoso.example	All apps	Clients: ActiveSync, Other legacy	Block
On	All users	breakglass@contoso.example, annabel.fraser@contoso.example	All apps	Platforms: windows, macOS	Compliant device or Hybrid joined
On	All users	breakglass@contoso.example	All apps	Locations	Block
On	All users	breakglass@contoso.example	1 app		MFA
On	11 admin roles Global Administrator Security Administrator SharePoint Administrator Exchange Administrator Conditional Access Administrator Application Administrator Cloud Application Administrator Password Administrator Privileged Authentication Administrator Privileged Role Administrator User Administrator	breakglass@contoso.example	All apps		Session controls
On	All users	breakglass@contoso.example + 11 admin roles breakglass@contoso.example Global Administrator Security Administrator SharePoint Administrator Exchange Administrator Conditional Access Administrator Application Administrator Cloud Application Administrator Password Administrator Privileged Authentication Administrator Privileged Role Administrator User Administrator	All apps		Session controls
On	All users	breakglass@contoso.example	User actions		MFA
On, but never applies (needs Entra ID P2) medium	All users	breakglass@contoso.example	All apps	User risk: high	MFA
On, but never applies (needs Entra ID P2) medium	All users	breakglass@contoso.example	All apps	Sign-in risk: high	Block

19 of 20 enabled accounts are covered by an enforced policy that requires MFA for all apps.

Admin roles: Exchange Administrator Clear filters

Account	Type	Admin roles	MFA required by	Legacy sign‑in blocked	Excluded from
g#EXT#@contoso.example	Guest	Exchange Administrator	CA001 — Admins: Require phishing-resistant MFA	Yes	CA002 — All users: Require MFA, CA008 — All users: 8h sign-in frequency

Data from Conditional Access (2 hours ago), Admin roles (2 hours ago), Users (2 hours ago).

Conditional Access coverage

Policies 11

Coverage by account 1 of 20