How to find administrators without MFA in Microsoft 365

What this check looks at

Cross-references every holder of a privileged directory role against authentication method registration.

Every holder of a privileged Microsoft Entra role (Global Administrator, Privileged Role, Security, Exchange, SharePoint, Teams, User, Helpdesk, Authentication and the other administrator roles in the privileged list) can change the tenant’s security settings, reset other people’s credentials or reach company data. Microsoft 365 does not make anyone register a second factor when a role is assigned. Microsoft now enforces MFA when someone opens the Azure portal and the Microsoft Entra, Intune and Microsoft 365 admin centres, but that does not cover every app an administrator signs in to, such as Outlook, Teams or the Exchange Online PowerShell module.

This check lists every enabled account holding one of those roles, permanently or as a PIM-eligible assignment, and compares it with the authentication methods registration report. The check fails when at least one enabled privileged account has no multi-factor method registered at all. It warns, without failing, when nothing is known to be missing but registration could not be confirmed for some role holders, which is usually a group or a service principal holding the role.

An administrator without a registered method is protected by a password alone. Password spraying, a password reused from another breach or one convincing phishing page gives the attacker the account, and because no method is registered the attacker can register their own authenticator app and keep it. From a Global Administrator they can create new admin accounts, add mail forwarding, consent to malicious apps and turn off logging before anyone notices.

Why it matters

A privileged account without MFA is a complete tenant takeover waiting for one phishing email. Recovery from a compromised Global Administrator typically means a forensic engagement and a full credential reset across the estate.

A typical case: the office manager of a 40-person firm holds User Administrator so they can reset passwords. Their password is reused from a breached shopping site, it is sprayed against Microsoft 365, and because the account never registered MFA the sign-in succeeds. The attacker resets the finance director’s password, reads the mailbox and sends a supplier bank-change letter that costs tens of thousands of pounds. Recovery means a forensic review, a reset of every administrator and often every user, and days of disruption.

Administrators are the accounts where an attacker’s payoff is highest and MFA is cheapest to add, because there are only a handful of them. If personal data is exposed through a compromised admin account, the organisation must decide whether to report it to the ICO within 72 hours under UK GDPR, and an administrator protected only by a password is hard to defend as an appropriate technical measure.

CIS Microsoft 365 Foundations Benchmark 5.2.2.1 requires MFA for every account in an administrative role, and CIS Controls v8 safeguard 6.5 requires MFA for administrative access. ISO 27001 A.8.2 and A.8.5 cover privileged access and secure authentication, the NCSC CAF privileged user management outcome and Cyber Essentials’ user access control requirement expect it, and the Essential Eight “restrict administrative privileges” strategy and NIST CSF PR.AA-05 make the same point.

How to fix it

Where: Entra admin centre → Identity → Roles and administrators

Before you start

• Contact each listed administrator today; an administrator without MFA is the most valuable account an attacker can take over.
• Issue a Temporary Access Pass if someone cannot register straight away.

Step by step

1. 1Confirm who is affected. Export the accounts and roles listed in the evidence. In the Microsoft Entra admin centre, go to Entra ID > Authentication methods > User registration details, search for each account (or filter on the Admin column where shown) and confirm Multifactor authentication capable is No. Mark any account used by a script rather than a person, and the Microsoft Entra Connect sync account (Sync_…, Directory Synchronization Accounts role), which cannot register MFA and is handled by excluding it from MFA policies instead.
2. 2Make Temporary Access Pass available. In Entra ID > Authentication methods > Policies, open Temporary Access Pass, set Enable to on and target a group containing your administrators (or All users). On the Configure tab choose one-time use and a default lifetime of about one hour. This lets an administrator register a strong method without needing a working second factor first.
3. 3Issue a pass to each administrator. For each listed person, go to Entra ID > Users, open the account, select Authentication methods > Add authentication method > Temporary Access Pass and create it. Give the pass to the person on a call or in person after confirming who they are, never by email to the mailbox of the account it unlocks.
4. 4Register a strong method. The administrator signs in at https://aka.ms/mysecurityinfo with the pass and adds a FIDO2 security key or a passkey in Microsoft Authenticator (Microsoft Authenticator push is the minimum if neither is available yet), plus a second method as a backup. Refresh User registration details and check the account now shows Multifactor authentication capable: Yes.
5. 5Move automation accounts to an app identity. Where a listed account is used by a script or integration, do not register MFA on a shared phone. Create an app registration (Entra ID > App registrations > New registration), add a certificate under Certificates & secrets, grant only the permissions the script needs, and change the script to sign in as the app. Then remove the directory role from the old account and block its sign-in.
6. 6Create the admin MFA policy in report-only mode. Go to Entra ID > Conditional Access > Policies > New policy, or start from the template Require multifactor authentication for admins. Under Users, include Directory roles and select every administrator role in use (at least Global, Privileged Role, Security, Exchange, SharePoint, Teams, User, Helpdesk, Authentication, Application and Cloud Application Administrator), and exclude your two emergency access accounts. Target All resources. Under Grant choose Require authentication strength: Multifactor authentication for now, and Phishing-resistant MFA once every administrator has a key or passkey. Set Enable policy to Report-only and select Create.
7. 7Review the results and switch the policy on. After a few days, open Entra ID > Monitoring & health > Sign-in logs, filter on each administrator and open the Report-only tab of recent sign-ins. Results should be Report-only: Success, or User action required for someone who has not yet registered. Fix any unexpected failure, then open the policy, set Enable policy to On and save.
8. 8Confirm every administrator is covered. Re-run User registration details: every privileged account should show Multifactor authentication capable: Yes. Sign in as one administrator in a private browser window and check the sign-in log’s Conditional Access tab shows the new policy applied with MFA satisfied. The finding clears at the next assessment.

What users will notice

The listed administrators must register a method and use it when they sign in.

How to confirm it worked

Authentication methods, User registration details, filtered on the admin roles, shows every administrator as MFA capable.

Frameworks and controls

This check maps to controls in 18 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.

The framework mappings were last checked against the published standards in October 2026.

Microsoft’s documentation

• Secure privileged access (Microsoft Learn)

Related checks

• How to find users without MFA in Microsoft 365
• How to require MFA for every user with Conditional Access
• How to require MFA for administrator roles in Entra ID
• How many Global Admins should a Microsoft 365 tenant have?

The full Microsoft 365 security checklist, worst first