What the survey found, floor by floor

10 failing · 3 partial · 13 passing

FailIDN-009

Administrators must use phishing-resistant MFA

No Conditional Access policy requires phishing-resistant MFA for administrators, so a fake sign-in page can relay their MFA.

Estate exposed: 100%
Affected: 4
Place in plan: 12

Routes using it: Administrator compromise to full tenant takeover, MFA bypassed by session-token theft
Cyber Essentials: Not mapped
ISO 27001: A.8.2, A.8.5
Read from: demo:ca_policies, demo:roles

Affected · 4

eleanor.finch@harbourfinch.exampleit.admin@harbourfinch.examplemarcus.harbour@harbourfinch.examplepriya.shah@harbourfinch.example

Facts recorded

{
  "policies": [],
  "administrators": [
    "eleanor.finch@harbourfinch.example",
    "it.admin@harbourfinch.example",
    "marcus.harbour@harbourfinch.example",
    "priya.shah@harbourfinch.example"
  ],
  "unprotected": [
    "eleanor.finch@harbourfinch.example",
    "it.admin@harbourfinch.example",
    "marcus.harbour@harbourfinch.example",
    "priya.shah@harbourfinch.example"
  ]
}

See the fix in the plan