Skip to content

Ward opens soon: join the waitlist and we'll email you the day we open.

What Ward checks

Area: Email

Microsoft 365

With your Microsoft 365 connected (read-only): multifactor authentication, global administrators, forgotten accounts and users Microsoft flagged as at risk.

What it can report

Open each one to see what it means and how to fix it.

Microsoft 365 admins without MFA

What it means

Some administrator accounts of your Microsoft 365 tenant sign in with just a password, without multifactor authentication. An administrator can read anyone's email, create accounts and change every setting.

What could happen

It's the most valuable account in the company. If its password is stolen through phishing or a breach, the intruder takes over the whole tenant. It is critical.

How an attacker would use it

An administrator receives a fake “Microsoft security alert” and types their password into a copy of the sign-in page. With nothing else to stop them, the attacker signs in as administrator and creates their own hidden account.

How to fix it

  1. Ask each administrator in the list to register MFA in their Microsoft account today.
  2. Prefer Microsoft Authenticator or a security key rather than SMS codes.Security keys can't be phished; SMS codes can be intercepted.
  3. In Microsoft Entra admin center (entra.microsoft.com), require MFA for administrators with security defaults or conditional access.
  4. Check that no administrator account is shared between several people.

How to check it's fixed

Ward reads your tenant again at each scan. The finding disappears when every administrator has MFA registered.

Who usually fixes it

Your IT person

Example with sample data. In your dashboard, the explanation uses your own domain and details.

Microsoft 365 accounts without MFA

What it means

These people in your Microsoft 365 tenant sign in with just their password. Multifactor authentication adds a second check, usually a prompt on their phone.

What could happen

Passwords get stolen through phishing or other services' breaches. Without a second step, whoever has the password reads that person's email and can write to customers from it.

How an attacker would use it

A password reused on another website leaks in a breach. Someone tries it on the company email, gets in, and sends customers an invoice with a new bank account.

How to fix it

  1. Tell the people in the list why it matters and ask them to register MFA.
  2. Recommend Microsoft Authenticator on the phone: it's the easiest option for most people.
  3. In Microsoft Entra admin center (entra.microsoft.com), make MFA mandatory with security defaults or conditional access.

How to check it's fixed

Ward reads your tenant again at each scan. The finding disappears when everyone in the list has MFA.

Who usually fixes it

Your IT person

Example with sample data. In your dashboard, the explanation uses your own domain and details.

MFA not enforced

What it means

In your Microsoft 365 tenant, MFA isn't mandatory: security defaults are off and no conditional access policy requires it for everyone.

What could happen

Whatever is optional ends up undone. New accounts start without MFA, and anyone can switch it off. Making it mandatory keeps the protection by default.

How an attacker would use it

A new employee starts and never registers MFA because nothing requires it. Months later their password leaks and nobody notices that account was left unprotected.

How to fix it

  1. In Microsoft Entra admin center (entra.microsoft.com), turn on security defaults, or
  2. Create a conditional access policy that requires MFA for all users (needs Entra ID P1).
  3. Give people a few days to enrol before enforcement starts.

How to check it's fixed

Ward reads your policies again at each scan. The finding disappears when MFA is mandatory for everyone.

Who usually fixes it

Your IT person

Example with sample data. In your dashboard, the explanation uses your own domain and details.

Too many global administrators

What it means

Your Microsoft 365 tenant has more global administrators than it needs. Each one can do everything: read any email, delete accounts, change security settings.

What could happen

Every global administrator is another master key. The more there are, the more chances one of them is stolen, and the harder it is to know who changed what.

How an attacker would use it

One of several global administrators, who barely uses the admin center, falls for a phishing email. The intruder now has full control without targeting the person who actually manages the tenant.

How to fix it

  1. Decide who really needs to be a global administrator: two or three people are usually enough.
  2. In Microsoft Entra admin center (entra.microsoft.com) or In the Microsoft 365 admin center (admin.microsoft.com), remove the Global Administrator role from the rest.
  3. Give those who still manage something a narrower role, such as User Administrator or Helpdesk Administrator.
  4. Make sure the remaining global administrators have MFA with a security key.

How to check it's fixed

Ward reads your directory roles again at each scan. The finding disappears when there are three global administrators or fewer.

Who usually fixes it

Your IT person

Example with sample data. In your dashboard, the explanation uses your own domain and details.

Forgotten Microsoft 365 accounts

What it means

These Microsoft 365 accounts are still active but nobody has signed in to them for months. They are often former employees, interns or test accounts that were never closed.

What could happen

An account nobody uses still has a password and access to email and files. If that password leaks, an intruder can use it without anyone noticing.

How an attacker would use it

A former employee's password appears in a breach. Someone signs in to their still-active work account, reads old emails with customers, and uses them to send a convincing fake invoice.

How to fix it

  1. Check each account in the list: is it a former employee, a test account or someone on leave?
  2. In the Microsoft 365 admin center (admin.microsoft.com), block sign-in for the accounts you no longer need.You can keep their mailbox and files, or transfer them first.
  3. For the accounts you keep, reset the password and require MFA.
  4. Add closing work accounts to your process for when someone leaves the company.

How to check it's fixed

Ward reads sign-in activity again at each scan (needs Entra ID P1). The finding disappears when no active account has gone unused for more than 90 days.

Who usually fixes it

Your IT person

Example with sample data. In your dashboard, the explanation uses your own domain and details.

Users flagged as at risk by Microsoft

What it means

Microsoft Identity Protection has flagged these accounts as at risk: unusual sign-ins or credentials seen in a leak.

What could happen

It may be the person travelling, but it's also the typical sign that someone else has their password. If it wasn't them, the intruder may already have read their email.

How an attacker would use it

Someone with a stolen password signs in from another country. Microsoft flags it, but if nobody checks, the intruder sets up a forwarding rule and starts writing to customers.

How to fix it

  1. In Microsoft Entra admin center (entra.microsoft.com), open Identity → Risky users and review each account in the list.
  2. If it wasn't them, reset their password and revoke their sessions.
  3. Require MFA on those accounts if they don't have it.
  4. Check their mailbox for forwarding rules or filters they didn't create.

How to check it's fixed

Ward reads Identity Protection again at each scan (needs Entra ID P2). The finding disappears when no user is left in a risky state.

Who usually fixes it

Your IT person

Example with sample data. In your dashboard, the explanation uses your own domain and details.