Finding admin accounts without MFA in Microsoft 365

To find admin accounts without MFA in Microsoft 365, cross-reference three places in the Microsoft Entra admin center: Roles & admins (who holds privileged roles), Authentication methods → User registration details (who has registered a strong method), and Conditional Access (who is required to use one). An account in the first list but missing from the others, or excluded from your MFA policy, is an unprotected privileged account. The sections below work through it, including the gaps that hide.

The exact places to check

In the Microsoft Entra admin center: Identity → Roles & admins enumerates the privileged roles that matter: Global Administrator, Privileged Role Administrator, Exchange and SharePoint Administrator, and the rest. Protection → Authentication methods → User registration details reports who has a strong method registered, and Protection → Conditional Access shows which policies enforce it, and on whom.

What to look for

• Privileged accounts with no strong method registered. A Global Admin whose only method is a phone number, or nothing at all, is the first thing to fix.
• Conditional Access gaps. A policy that “requires MFA” but excludes certain users, groups, or apps often quietly excludes the very admins it should protect.
• Legacy authentication still allowed. Older protocols (IMAP, POP, SMTP AUTH, legacy Exchange) can bypass Conditional Access and MFA entirely. If legacy auth is on, your MFA policy has a side door.
• Break-glass accounts. Emergency-access accounts are deliberately excluded from MFA policies. That’s legitimate, and they need long passwords, tight monitoring, and periodic review.
• Weak methods. SMS and voice can be phished. App-based or passwordless methods are the goal for admins.

The catch with doing it manually

Each of these lives in a different blade. The question you care about, which privileged accounts are protected in practice, only gets answered when you join role assignments to registration state to Conditional Access coverage to the legacy-auth setting. Doing that by hand across a real tenant, it’s easy to conclude “MFA is enforced” while an excluded admin or an open legacy protocol says otherwise.

A faster path

Esmeris does this join for you. A read-only audit flags privileged accounts without effective MFA and the Conditional Access gaps around them, ranked by risk in a graded report.