Contoso Legal LLP
contoso.onmicrosoft.com
Fully protected
16 of 19
84% of enabled members
No MFA at all
1
Not set up and not required
Set up, not required
0
A password alone gets in
Required, not set up
2
Anyone with the password can set it up
Admins with a gap
1
Fix these first
Setting up MFA and being required to use it are separate. Both are needed.
Enabled members who either haven't set up MFA or aren't required to use it. Admins first.
| Admin roles | Gap | MFA set up | Required by | Excluded from |
|---|---|---|---|---|
| Global Administrator critical | No MFA | No | Nothing | CA001 — Admins: Require phishing-resistant MFA, CA002 — All users: Require MFA, CA003 — Block legacy authentication and 8 more |
What it means: Not set up and not required: the password alone gets in. | ||||
| medium | Required, not set up | No | CA002 — All users: Require MFA | |
What it means: Will be asked to set up MFA at next sign-in. Until then, anyone with the password can set it up in their place. | ||||
| medium | Required, not set up | No | CA002 — All users: Require MFA | |
What it means: Will be asked to set up MFA at next sign-in. Until then, anyone with the password can set it up in their place. | ||||
| Account | Admin roles | Methods | Required by |
|---|---|---|---|
| rhys.evans@contoso.example | Phone | CA002 — All users: Require MFA | |
| sophie.taylor@contoso.example | Phone | CA002 — All users: Require MFA | |
| william.allen@contoso.example | Phone | CA002 — All users: Require MFA |
Guests set up MFA in their own organisation, so only whether this tenant requires it is shown.
| Guest | Required by | Excluded from |
|---|---|---|
| g#EXT#@contoso.example | CA001 — Admins: Require phishing-resistant MFA | CA002 — All users: Require MFA, CA008 — All users: 8h sign-in frequency |
Data from Users (), MFA registration (), Conditional Access (), Per-user MFA (), Admin roles ().