Privileged Account Without MFA

A privileged directory role (Global Administrator or equivalent) is assigned to an account that has not registered a strong MFA method, as seen with a BrightPath Dental privileged Microsoft 365 account.

Updated Aug 20, 2026mfaidentitymicrosoftRun in Fix Center

Trigger: Identity evidence from Microsoft 365/Entra ID or Active Directory shows a privileged role assignment with no registered MFA method, or MFA satisfied only by a weak method such as SMS where policy requires phishing-resistant methods.
Risk: Privileged accounts without MFA are the highest-value target for credential-based attacks; a single compromised password grants tenant-wide administrative access. This directly affects AIQ-ID-004 and downstream access-control assurance.

Prerequisites

Confirm the account's current role assignment and whether it is a break-glass/emergency account (which may be intentionally excluded)
Identify the account owner and their available authentication devices
Confirm the tenant's Conditional Access or per-user MFA enforcement mechanism

Recommended fix

Confirm the account is not an approved, documented break-glass account; if it is, apply the break-glass exception process instead of this playbook.
Contact the account owner and have them register a phishing-resistant MFA method (authenticator app or hardware key).
Apply or extend a Conditional Access policy requiring MFA for all users assigned privileged directory roles.
Force re-authentication for the account so the new policy takes effect immediately rather than at next natural sign-in.
Re-run identity evidence collection to confirm the registered method and policy enforcement.

Validation

Identity Workbench shows the account with a registered strong MFA method
Conditional Access policy evidence shows the account is in scope for MFA enforcement
AIQ-ID-004 control state moves to PASS with updated evidence

Rollback and recovery

If enforcement locks out the account unexpectedly, temporarily exempt the specific account while the user completes registration, then remove the exemption.
No configuration change needs to be reverted once MFA registration succeeds.

Evidence generated

Registered authentication method evidence for the account
Conditional Access policy scope evidence including the account
Updated AIQ-ID-004 control observation