MFA coverage
98%
of active users · the remainder are break-glass and 2 legacy-authentication service accounts
Conditional Access
7
policies active
PIM-managed roles
12
eligible · 2 break-glass accounts, 0 other standing
Inactive guests
9
inactive > 90 days · removal scheduled
Legacy auth
2
service accounts bypassing MFA
Entra ID · the strongest area at 88 / 100
MFA, Conditional Access and Privileged Identity Management govern who can use Copilot and with what privileges. Two items remain open; neither blocks a scoped pilot.
ControlDetailOwnerStatusAction
MFA & Conditional Access baselineAll users are covered except break-glass accounts. Legacy authentication is blocked, and a compliant device is required for administrative roles.ZertainConfiguredDone
Privileged Identity ManagementAdministrative roles are eligible-only and require approval and justification. Only the 2 break-glass accounts hold standing Global Administrator access.ZertainConfiguredDone
Access reviewsQuarterly reviews are configured for privileged roles and guest access.ZertainConfiguredDone
Legacy authentication blockTwo service accounts still use legacy authentication, which bypasses MFA. The owning application has not yet been identified.GDC ITOpen
Inactive guest cleanupNine guests inactive for more than 90 days retain access to content shared with them. The removal batch has been approved.Security & ComplianceScheduled