Problem overview
Security gaps often arise when users overlook or disable multi-factor authentication on Windows devices. This monitor proactively identifies missing MFA configurations, helping IT teams address vulnerabilities before they escalate.
Monitors
warning 1 check
- Windows Monitor - MFA Check Windows MFA Check (Script monitor)
This script runs every hour to evaluate key MFA-related security features on Windows workstations, such as Windows Hello for Business, biometric services, PIN enforcement, Secure Logon, and Azure AD join status. If it detects that fewer than two factors are enabled, it generates an alert signaling the device is not MFA-compliant. Once MFA is enabled or corrected, the alert automatically resolves without manual intervention.
Use cases
- Confirming Windows devices meet organizational MFA standards
- Monitoring newly onboarded endpoints for MFA compliance
- Automating proactive remediation processes for non-compliant devices
- Integrating with broader security policies and compliance audits
Recommendations
- Test Thoroughly: Always test this script in a controlled environment before deploying it across production devices.
- Pair with Automations: Create a follow-up automation that notifies end users or instructs them to enable MFA once the monitor generates an alert.
- Configure Policies: Ensure Windows Hello for Business, biometric, and PIN policies align with your organization’s security requirements.
- Set Clear Thresholds: Adjust the acceptable number of enabled factors in the script if your environment has unique compliance standards.