EIDAUTH-003: MFA Method Distribution Analysis
- Platform
- Entra ID / M365
- Category
- Entra ID Authentication Methods & MFA
- Severity
- Info
- Zero Trust pillar
- Identity (weight 1)
- Golden fixtures
- 2
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Understanding the distribution of MFA methods across users helps assess the overall strength of authentication controls. Organizations should track adoption of phishing-resistant methods like FIDO2 and Authenticator push versus weaker methods like SMS. This visibility enables targeted campaigns to migrate users to stronger methods.
Recommended value
Majority of users registered with phishing-resistant MFA methods (FIDO2, Microsoft Authenticator, Windows Hello)
Remediation
Review method distribution via Entra ID > Protection > Authentication methods > User registration details. Identify users relying solely on weaker methods and create migration plans. Use authentication method activity reports to track adoption progress.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| no-data | Not Assessed |
Framework mappings
- NIST SP 800-53
- IA-2(1)