If your Microsoft 365 scan shows MFA as NEEDS ATTENTION or REVIEW, it means users in your tenant can sign in with just a username and password. That's the single highest-risk configuration in Microsoft 365.
Password spray attacks — where attackers try common passwords against thousands of accounts — are automated and constant. Microsoft reports that MFA blocks over 99.9% of account compromise attacks. Without it, a weak password, a reused password, or credentials bought from a data breach is all an attacker needs.
Once inside a Microsoft 365 account, attackers can: read and exfiltrate email, access SharePoint and OneDrive files, set up mail forwarding rules to capture future emails, send phishing emails from a trusted domain, and move laterally to other systems.
Important distinction: There are three ways MFA can appear "enabled" in Microsoft 365 — per-user MFA (legacy, weak), Security Defaults (good), and Conditional Access with MFA (best). M365Clarity checks which approach is in use and whether it actually covers all users.
The oldest method. You enable MFA per user in the Microsoft 365 admin centre. Problems: it doesn't enforce MFA for service accounts, it doesn't block legacy authentication protocols like SMTP and IMAP that bypass MFA entirely, and it's hard to manage at scale.
A single toggle in Entra ID that enables MFA for all users, blocks legacy authentication, and protects admin accounts with more aggressive MFA requirements. It's free, takes 30 seconds to enable, and is a huge improvement over nothing. The limitation: you can't customise it — it's all or nothing.
How to enable: Entra ID → Properties → Manage Security Defaults → Enable.
Conditional Access lets you build rules: "require MFA when signing in from outside a trusted location," "block access from high-risk countries," "require compliant device for access to sensitive apps." It requires Azure AD P1 licences (included in Business Premium and above).
Essential Conditional Access policies to create:
The fastest way: connect your Microsoft 365 tenant to M365Clarity. It checks MFA status, Conditional Access configuration, legacy authentication blocking, and admin role protection in a single scan — and tells you exactly what to do.
The manual way: Entra ID → Security → Conditional Access → Policies. If you see no policies, or only "Security Defaults" style settings, you're likely using legacy MFA or Security Defaults.
M365Clarity scans your Microsoft 365 configuration and tells you exactly what's configured and what isn't — in plain English.
Scan your tenant free →Related articles