Administrators Without MFA

What this means

One or more administrator accounts do not have MFA enabled. Admin accounts have elevated privileges and are the most targeted accounts in any organisation.

Why is it a security risk?

• A compromised admin account without MFA gives an attacker immediate, privileged access to your tenant — they can create backdoors, export data, and modify security settings.
• Admin accounts are specifically targeted in spear-phishing campaigns because of their high value.
• This is flagged as Critical because it combines two risk factors: high-privilege access and missing MFA protection.

Recommended next steps

1. Immediately enable MFA for all admin accounts. This is Microsoft's #1 security recommendation.
2. Create a Conditional Access policy that requires MFA for all directory roles.
3. For the highest-privilege roles (Global Admin, Privileged Role Admin), require phishing-resistant MFA (FIDO2 or Windows Hello).
4. Ensure your emergency access accounts have MFA configured separately (e.g., FIDO2 key in a safe).