Users Without MFA

What this means

Users were found that do not have any Multi-Factor Authentication (MFA) method registered. This means they authenticate with only a password — a single factor that can be phished, guessed, or stolen.

Why is it a security risk?

• Microsoft reports that MFA blocks 99.9% of account compromise attacks. Accounts without MFA are the lowest-hanging fruit for attackers.
• Credential leaks from third-party breaches are common — if the user reuses passwords, their Entra ID account is immediately at risk.
• Without MFA, phishing attacks only need to capture a single password to gain full access.

Recommended next steps

1. Enable Microsoft Entra MFA for all users via Conditional Access or Security Defaults.
2. Use the Authentication methods activity report to track registration progress.
3. Consider Authentication Strengths to require phishing-resistant methods (FIDO2, Windows Hello) for sensitive roles.
4. Run a registration campaign using the nudge feature to prompt users to set up the Authenticator app.