Office 365 Global Admins Multi-Factor Authentication (Legacy MFA) Status rule

Rule description

This rule queries Office 365/Azure Global Admins and for each user returned, reports the user's MFA status (Enabled, Disabled). This rule reports-on, but does not change the MFA status.

Note: This rule covers the legacy Microsoft MFA mechanism. The recommendation is to use the newer Conditional Access Policies or Security Defaults instead of legacy MFA. This rule will be redesigned in the future to take advantage of the newer mechanisms.

When to use this rule

Use this rule when you need to get the report with MFA statuses of Microsoft 365 Global Admins.

Rule Settings

Query Section

Setting name	Description
Properties to Display	To display additional properties for each object found by the query, add those properties to the list.
Sort by	Sort result objects list.
Maximum returned results	Specify integer value. By default, all objects that you have in Microsoft 365 are returned. Tip: It is possible to change the default value in Microsoft 365 extension settings.

Output Section

This section defines the output format of this rule.

To get more information about this section, please see the Output section article.

Enforce/Schedule section

This section defines the schedule for how often to run the rule.

To get more information about this section, please see the Enforce/Schedule section article.

Change History

Version	Notes
8.2.0	The rule is updated and renamed. Detect if MFA is enabled via policy is removed.

Articles in this section