Finding admin accounts without MFA in Microsoft 365

To find admin accounts without MFA in Microsoft 365, cross-reference three places in the Microsoft Entra admin center: Roles & admins (who holds privileged roles), Authentication methods → User registration details (who has actually registered a strong method), and Conditional Access (who is actually required to use it). An account in the first list but missing from the others — or excluded from your MFA policy — is an unprotected privileged account. Here’s how to work through it, including the gaps that hide.

The exact places to check

In the Microsoft Entra admin center: Identity → Roles & admins enumerates the privileged roles that matter — Global Administrator, Privileged Role Administrator, Exchange and SharePoint Administrator, and the rest. Protection → Authentication methods → User registration details reports who actually has a strong method, and Protection → Conditional Access shows which policies enforce it, and on whom.

What to look for

• Privileged accounts with no strong method registered. A Global Admin whose only method is a phone number — or nothing at all — is the first thing to fix.
• Conditional Access gaps. A policy that “requires MFA” but excludes certain users, groups, or apps often quietly excludes the very admins it should protect.
• Legacy authentication still allowed. Older protocols (IMAP, POP, SMTP AUTH, legacy Exchange) can bypass Conditional Access and MFA entirely. If legacy auth is on, your MFA policy has a side door.
• Break-glass accounts. Emergency-access accounts are deliberately excluded from MFA policies — legitimate, but they need strong long passwords, tight monitoring, and review.
• Weak methods. SMS and voice are better than nothing but phishable; app-based or passwordless methods are the goal for admins.

The catch with doing it manually

Each of these lives in a different blade, and the real answer — “which privileged accounts are genuinely protected?” — only appears when you join role assignments to registration state to Conditional Access coverage to whether legacy auth is disabled. Do that by hand across a real tenant and it’s easy to conclude “MFA is enforced” while an excluded admin or an open legacy protocol says otherwise.

A faster path

Esmeris does this join for you: a read-only audit that flags privileged accounts without effective MFA and the Conditional Access gaps around them, then ranks them by risk in a graded report. See the sample report for what that looks like.