Multi-Factor Authentication Coverage

Goal of the analysis:

Measure how comprehensively multi-factor authentication (MFA) is enforced and successfully used across users, administrators, third parties, and critical applications, and identify gaps, bypass paths, and improvement levers. MFA Coverage is a foundational control for reducing credential-based compromise. Executives use it to validate identity risk posture, comply with regulatory expectations, and prioritize rollout (e.g., phishing-resistant methods) with minimal user friction. The objective is near-100% MFA for privileged and high-risk identities, ≥95% for the broader workforce and external users, zero legacy-protocol bypass, and increasing adoption of phishing-resistant factors.

Data required:

• Identity and MFA configuration:
  • IdP tenant data (Azure AD/Entra, Okta): user list, groups/roles, MFA registration status (methods per user), enforcement status, conditional access (CA) policies, exclusions.
  • Privileged roles (Global Admin, Privileged Role Admin, root/Owner), break-glass accounts, service/robot accounts.
• Authentication and policy telemetry:
  • Auth logs: successful/failed authentications, MFA challenges, method used, risk evaluation, device and location context.
  • Legacy protocol usage (IMAP/POP/SMTP Basic, NTLM/LDAP bind), app passwords, token lifetimes/refresh behavior.
• Application and SSO coverage:
  • Catalog of applications with SSO onboarding status (SAML/OIDC), criticality tier, data sensitivity, audience, and whether CA applies.
  • SaaS and custom apps outside SSO (direct auth), VPN/remote access systems and MFA status.
• Workforce and third-party context:
  • HRIS: employee/contractor/guest status, BU, region, role; vendor/partner roster and contract dates.
  • Frontline vs knowledge worker designations; device eligibility for authenticator apps/hardware keys.
• Support and exception data:
  • Help desk tickets: MFA enrollment issues, resets/lockouts; exception/waiver registers with expiry and compensating controls.
• Systems and sources:
  • IdP (Azure AD/Okta), CA insights, SIEM, PAM, IGA, VPN/NAC, HRIS, app inventory/CMDB, BI/warehouse.

Detailed step-by-step instruction on how to conduct the analysis:

1. Define scope and metrics:
   • In-scope identities: employees, contractors, partners/guests; privileged identities and break-glass accounts separately; exclude non-interactive service accounts from MFA numerator (manage via managed identities/PAM).
   • Core KPIs:
     • MFA Coverage (Users) = Users with MFA enforced and at least one registered factor ÷ Eligible interactive users × 100%.
     • Privileged MFA Coverage = Privileged identities with MFA enforced and registered ÷ Total privileged identities × 100%.
     • Effective MFA Rate = Authentications where MFA was evaluated/enforced ÷ Total interactive authentications × 100%.
     • Phishing-Resistant Share = Users with FIDO2/Passkey/Certificate/Smartcard registered ÷ MFA-registered users × 100%.
     • Legacy Bypass Rate = Auths via legacy/basic protocols or app passwords ÷ Total authentications × 100%.
2. Extract and normalize:
   • Pull IdP user roster, MFA registration/enforcement flags, CA policy assignments, exclusions, and role memberships.
   • Export authentication logs (last 90–180 days) with MFA prompts and method; extract legacy protocol usage and app-password events.
   • Join HRIS and vendor data to tag identity type, BU/region/role; map apps to SSO onboarding and criticality.
3. Compute coverage and effectiveness:
   • Calculate KPIs overall and by segment (BU, region, role, identity type, app criticality).
   • Registration funnel: Licensed/Eligible → MFA Enforced → MFA Registered → First MFA Success; drop-off at each stage.
   • Breakouts by MFA method (Authenticator app push/number match, TOTP, SMS/voice, FIDO2/passkey, smartcard, certificate).
4. Assess policy posture and bypass vectors:
   • List CA policies and coverage (% users/apps in scope), risky exclusions (e.g., “trusted locations,” legacy protocol allowances), session lifetimes, and sign-in frequency.
   • Quantify legacy protocol usage (IMAP/POP/SMTP basic, NTLM/legacy LDAP binds) and app passwords; map to users/apps.
   • Evaluate SSO coverage of critical apps; identify direct-auth apps lacking MFA.
5. Segment high-risk cohorts:
   • Privileged/admin accounts, third parties/guests, high-target departments (finance, engineering), and internet-exposed apps.
   • Flag any admin/guest without MFA or using SMS/voice; list break-glass accounts and controls.
6. Trend and correlate:
   • Plot monthly coverage, effective MFA rate, phishing-resistant share, and legacy bypass rate (rolling 3 months).
   • Correlate suspicious sign-ins/compromised accounts with MFA status and method used.
7. Root cause analysis:
   • Pareto gaps by cause: CA exclusions, legacy protocols required by specific apps, enrollment failures, device constraints, third-party limitations, SSO onboarding backlog.
   • Quantify impact: number of users/apps affected and remediation effort.
8. Validate and institutionalize:
   • Review findings with IAM, SecOps, and application owners; confirm exceptions and target dates.
   • Automate dashboard refresh; set alerts for privileged accounts without MFA, rising legacy usage, or drops in effective MFA rate.

Format of the output of analysis:

• Executive summary: MFA Coverage (overall and privileged), Effective MFA Rate, Phishing-Resistant Share, Legacy Bypass Rate, biggest gaps, and top actions.
• Coverage heat maps: by BU/region/role and by identity type (employee/contractor/guest); special panel for privileged.
• Policy posture matrix: CA policies vs user/app cohorts (coverage, exclusions) and SSO onboarding status for critical apps.
• Registration funnel: Eligible → Enforced → Registered → First MFA Success, with drop-off percentages.
• Method mix chart: distribution of MFA methods (push/number match, TOTP, SMS/voice, FIDO2, smartcard) and trends.
• Bypass panel: legacy protocol/auth counts, app passwords, and affected users/apps; exception list with expiry.
• Detail table: user/app/cohort, MFA status, method(s), last MFA success, CA policies applied, exclusions, owner, remediation ETA.

How to interpret results:

• High MFA Coverage (≥95% workforce; 100% privileged) with high Effective MFA Rate and low Legacy Bypass indicates strong posture; confirm that phishing-resistant share is rising and that exclusions are justified and time-boxed.
• High coverage but low effective rate suggests bypass via legacy protocols, app passwords, or session lifetimes; tighten CA and disable legacy auth.
• Low privileged or third-party coverage is an urgent risk—address before broad user expansion.
• Heavy SMS/voice usage increases phishing/SIM-swap risk; shift to authenticator app, FIDO2, or smartcards—especially for admins.
• Low SSO coverage for critical apps undermines MFA; prioritize federation and conditional access enforcement.
• Trend lens: step-ups after policy rollouts are expected; sustained plateaus often reflect onboarding or device constraints—resolve root causes.

Steps a company can take to improve on this measure:

• Policy and controls:
  • Mandate MFA for all users; require phishing-resistant MFA for privileged roles; block legacy authentication and app passwords globally, with time-boxed exceptions.
  • Harden conditional access: enforce device compliance for sensitive apps, step-up for risky sign-ins, limit session lifetimes, require re-auth for privileged actions.
• Identity architecture and app onboarding:
  • Accelerate SSO federation (SAML/OIDC) for all critical apps and VPN; deprecate direct auth; integrate SCIM for lifecycle.
  • Adopt managed identities/service principals for non-interactive access; remove MFA prompts from service accounts by design.
• Enrollment and user experience:
  • Implement guided self-service registration with backup factors; enable number matching/push notifications; seed FIDO2 keys for admins and high-risk cohorts.
  • Minimize friction via trusted devices and adaptive policies; maintain minimal break-glass accounts with strict monitoring.
• Third-party and guest access:
  • Require MFA for B2B/guest users; enforce conditional access on external tenants; time-box vendor access with automatic expiry.
• Monitoring and governance:
  • Dashboard MFA coverage/effectiveness weekly; alert on privileged users without MFA, legacy auth spikes, or method downgrades (e.g., shift to SMS).
  • Track exception inventory and expiries; tie owner KPIs to closing gaps; include MFA in quarterly access certifications.
• Targeted actions by signal:
  • If legacy bypass is high: disable legacy protocols, revoke app passwords, and provide modern client guidance.
  • If registration drop-off is high: simplify enrollment UX, add just-in-time prompts, and provide assisted enrollment for frontline/contractors.
  • If SMS/voice dominates: default to authenticator app, distribute hardware keys for admins, and block SMS for privileged roles.
  • If SSO gaps exist: prioritize federation for top 20 critical apps; enforce CA on app access; retire direct logins.

Benchmark comparisons:

General benchmarks:

• Privileged identities: 100% MFA (phishing-resistant preferred) with zero legacy bypass; break-glass accounts ≤2 per tenant and continuously monitored.
• Workforce MFA Coverage: ≥95% of interactive users enforced and registered; Effective MFA Rate ≥90% of interactive authentications.
• Third-party/guest: ≥90–95% MFA enforced; higher for access to restricted data.
• Phishing-resistant adoption: 60–90% of admins and 20–60% of general workforce (rising over time).
• Legacy protocols: 0% allowed for interactive users; exceptions time-boxed with compensating controls.
• SSO coverage: ≥90% of critical apps federated with CA enforcement.

Segment- or industry-specific benchmarks:

• Regulated sectors (financial services, healthcare, public sector): MFA 100% across all users; phishing-resistant for admins and high-risk roles; strict prohibition of legacy auth.
• Remote-first/digital-native: rapid move to passwordless or passkeys for a majority of workforce; near-zero SMS usage.
• Frontline-heavy/global operations: strong coverage with authenticator or FIDO2; plan around SMS-restricted geographies with offline-capable methods.

If external benchmarks are not directly comparable (different identity stacks and definitions), construct internal benchmarks: track MFA Coverage, Effective MFA Rate, Phishing-Resistant Share, and Legacy Bypass Rate by BU/role over 4–8 quarters; set targets at internal top quartile and enforce guardrails (100% privileged MFA, 0 legacy bypass, time-boxed exclusions) to ensure sustained risk reduction.