MFA Status

An Azure AD Premium P1 or P2 license is required to access usage and insights.

Purpose:
Indicates whether the user has registered a strong authentication method for multi-factor authentication.

What does each status mean?

• Enabled: Validates some form of MFA is active on the account.
• Disabled: No form of MFA has been detected on the account.
  ** This is also be the case for Third-Party MFA.
• Blank: The User's MFA Status has not yet been received.

Additional notes:

In the near future, Huntress will introduce:

• Continual entire organization MFA Monitoring (currently constrained by MSFT events).
• Strength measures of various MFA implementations.
• Huntress detections for Users not secured by MFA.
• Threat Reporting (Quarterly, Monthly or Custom) to holistically address observed changes.