Global administrators without MFA
AI summary
Global administrators without MFA pose a high security risk because they have unrestricted access to your entire Microsoft 365 environment. This policy detects unprotected administrator accounts and recommends immediate MFA enforcement, continuous monitoring with Rencore Governance, and automatic notifications to non-compliant administrators.
What it detects
Shows global administratorsGlobal administratorGlobal Administrator is the Microsoft Entra admin role with access to every administrative feature in the tenant, including giving admin consent to apps for the whole organization.Read more that have not activated multi factor authentication.
Why it matters
Global administrators possess unrestricted access to your entire Microsoft 365Microsoft 365Microsoft 365 is the Microsoft cloud suite of Teams, SharePoint, OneDrive, Exchange and the Office apps.Read more environment, making unprotected accounts prime targets for attackers who could compromise your entire organization. Immediately enforce MFAMultifactor authenticationMultifactor authentication asks a user for a second form of verification, such as a code on their phone or a fingerprint, in addition to the password.Read more for all global administrator accounts without exception, use Rencore Governance to continuously monitor compliance and automatically notify non-compliant administrators, and consider implementing privileged identity management for additional security layers.
The rule
Every User that has any Role Members where Display Name equals 'Global Administrator' and no User Registration Credentials where Default MFA Method not like 'none'
UserIn Rencore Governance
Details
| Applies to | User |
|---|---|
| Connector | Microsoft 365 |
| Severity | High |
| Category | Security |
| Recommended | No |
| Recommended automation | None |
| License type | Standard |
Related policies
Other policies that check User objects:
- Copilot adoption opportunity - E3/E5 users (Medium)
- Copilot license assigned to disabled account (High)
- Inactive Copilot users - 30 days (Medium)
- Excessive draft agent creation pattern (Medium)
- External users (Information)
- External users with pending acceptance (Low)
- Users with Power Platform Premium license (Information)
- Users with E3 license not using Outlook in last 12 month (Low)
- Users with passwords not changed in last 6 months (Medium)
- Disabled user accounts (Medium)
- Admin accounts with an Office 365 E3 license assigned (Medium)
- Administrators without MFA (High)
- External users invited 3 month ago with pending acceptance (Low)
- Disabled user accounts with assigned licenses (High)
- Guest users with a Dynamics license assigned (Medium)
- Inactive external users (Medium)
- Inactive internal users (Medium)
- Over-licensed user accounts (High)
- Users who are creating Microsoft Loop Teams components (Medium)
Frequently asked questions
What does the global administrators without MFA policy detect?
The Global administrators without MFA policy shows global administrators that have not activated multi factor authentication.
Which objects does the global administrators without MFA policy check?
The Global administrators without MFA policy checks User objects from the Microsoft 365 inventory and reports each one that matches its rule as a violation.
How severe is a violation of the global administrators without MFA policy?
Violations of the Global administrators without MFA policy have High severity. The policy is in the Security category.
Which module includes the global administrators without MFA policy?
The Global administrators without MFA policy comes with the Microsoft 365 connector in the Digital Workplace module of Rencore Governance, which every Plan includes.
Was this page helpful?
Thanks for the feedback.
Thanks. What was wrong?