Shut these doors, in this order

Each door is one change, ordered by the exposure it removes and the certification requirements it completes per hour of work. Fixes interact, so the order is recalculated after every one.

Now · 5.5 hours

−8.8 exposure2 hoursIDN-002
An MFA policy only protects accounts that have actually registered a second factor. Unregistered accounts can be registered by whoever signs in first - including an attacker holding a stolen password.
1. Entra admin centre > Protection > Authentication methods > User registration details: filter 'Multifactor authentication capable = No'.
2. Contact each listed user and walk them through https://aka.ms/mysecurityinfo (Microsoft Authenticator preferred).
3. Prioritise administrators - they should use phishing-resistant methods (passkeys / FIDO2).
4. Enable the registration campaign (Authentication methods > Registration campaign) to nudge remaining users.
CompletesCE-UAC-MFAA.5.17

Next 30 days · 17 hours

Next 90 days · 7 hours

Shut these doors, in this order

Each door is one change, ordered by the exposure it removes and the certification requirements it completes per hour of work. Fixes interact, so the order is recalculated after every one.

Now · 5.5 hours

−8.8 exposure2 hoursIDN-002
An MFA policy only protects accounts that have actually registered a second factor. Unregistered accounts can be registered by whoever signs in first - including an attacker holding a stolen password.
1. Entra admin centre > Protection > Authentication methods > User registration details: filter 'Multifactor authentication capable = No'.
2. Contact each listed user and walk them through https://aka.ms/mysecurityinfo (Microsoft Authenticator preferred).
3. Prioritise administrators - they should use phishing-resistant methods (passkeys / FIDO2).
4. Enable the registration campaign (Authentication methods > Registration campaign) to nudge remaining users.
CompletesCE-UAC-MFAA.5.17