Team: Huntress Managed Identity Threat Detection and Response (ITDR, formerly MDR for Microsoft 365)
Environment: Huntress Platform
Summary: MFA Status for ITDR
A Microsoft Entra ID P1 or P2 (Azure AD Premium) license is required to access usage and insights.
This license is included in some Microsoft plans or can be purchased separately.
Purpose:
Indicates whether the user has registered a strong authentication method for multi-factor authentication.
What does each status mean?
- Enabled: Validates some form of MFA is active on the account.
-
Disabled: No form of MFA has been detected on the account.
** This is also be the case for Third-Party MFA - Blank: The User's MFA Status has not yet been received.
Per Microsoft licensing requirements, each identity must be licensed with its own Entra ID P1 or P2 (Azure AD Premium) license in order to display the MFA status. Missing licenses may result in inconsistent or incorrect statuses.