Posture check · Entra ID and hybrid
No baseline sign-in protection (T1078.004)
Neither security defaults nor a Conditional Access policy requires multifactor authentication for all users. A password alone signs a user in.
Why it matters
A sprayed or phished password gives an attacker working access, because nothing asks for a second factor.
How GraphnAI finds it
It runs after every sync, on each connected domain or tenant on its own. It applies to Microsoft Entra ID.
It reads:
- 2 more GraphnAI analyses
Why there's no automatic fix
GraphnAI doesn't create Conditional Access policies or change security defaults yet.
How to fix it
Turn on security defaults, or create a Conditional Access policy that requires multifactor authentication for all users and all resources. Conditional Access needs Microsoft Entra ID P1.
Related checks
MITRE ATT&CK® technique names and MITRE D3FEND™ technique labels: © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK® is a registered trademark and D3FEND™ a trademark of The MITRE Corporation.
See it on your own directory.
The Public Preview is free for 30 days from your first sync, on your own server.