Missing MFA on Privileged Accounts

What this finding is

An account holding administrative privilege — cloud root or global administrator, domain admin, privileged SaaS role, or an equivalent — can complete authentication with a password alone. This includes accounts where MFA is available but not enforced, where enforcement is bypassable through a legacy protocol, and where the second factor is SMS in an environment facing targeted attackers.

Why it is Tier 1

Credentials for privileged accounts are available in bulk from infostealer logs and prior breaches, and password reuse remains widespread. A single factor means one leaked or phished credential is sufficient for full administrative control, with no further exploitation required. This is the most consequential single control in most estates, and the remediation is usually a configuration change that can be completed the same day.

How to detect it

1. 1Enumerate every account with privileged role assignment across all identity providers — including local accounts on network appliances, which are routinely missed.
2. 2Report on MFA registration state rather than MFA policy state; a policy that exempts unregistered users enforces nothing.
3. 3Check for legacy authentication protocols (IMAP, POP3, SMTP AUTH, legacy Exchange) that bypass conditional access entirely.
4. 4Identify break-glass accounts and confirm they are covered by a compensating control — typically a split, sealed credential with alerting on use.

How to remediate it

Steps are ordered. The first step is the one that reduces exposure fastest, which is not always the one that closes the finding.

1. 1Enforce phishing-resistant MFA — FIDO2/WebAuthn or platform passkeys — on privileged accounts first; TOTP is an acceptable interim step, SMS is not.
2. 2Block legacy authentication protocols at the identity provider, since they defeat conditional access regardless of configuration.
3. 3Configure break-glass accounts with hardware tokens held under dual control, excluded from conditional access by design, and alerting on every authentication.
4. 4Extend enforcement to the whole population once privileged accounts are covered — the tier assignment falls to Tier 2 for non-privileged users.
5. 5Audit sign-in logs across the exposure window for successful single-factor privileged authentication from unfamiliar addresses.

How to verify the fix

Mappings

Other Tier 1 findings in Identity & Access Management