Almost every cyber insurance application asks whether multi-factor authentication is in place. Most small businesses answer yes, because most of their staff use it. The trouble is the accounts that don't, and insurers know exactly where to look for them.

Here are the five gaps that turn a "yes" into a "partly", and how to find each one in Microsoft 365.

1. People who never registered

Turning MFA on doesn't mean everyone set it up. New starters, part-timers and people who always dismiss the prompt often have no method registered at all. Until they do, a password is all an attacker needs.

The User registration details report, under Authentication methods in the Microsoft Entra admin center, lists every user and whether they have a method. Sort by "MFA capable" and follow up with each person on the No list.

2. Shared accounts

Scanners, front-desk logins and shared inboxes are often real user accounts with a password everyone knows. They rarely have MFA, because nobody owns the phone it would go to.

Replace them rather than protect them. Use scan-to-email through an SMTP relay or connector for scanners, and a shared mailbox for team inboxes. A shared mailbox needs no licence or password of its own. Then block sign-in for the old account.

3. Admins who rely on text-message codes

An admin who uses SMS codes has MFA, but the weakest kind. Codes can be redirected through a SIM swap, and admins are the accounts attackers want most.

Check each person who holds an admin role and make sure they use the Microsoft Authenticator app or a security key. Then remove SMS as a method for them. Microsoft now requires MFA to sign in to its own admin portals, but that doesn't make every admin method strong.

4. MFA registered but not required

This is the gap most often missed. A user can have Authenticator installed and still sign in with a password alone, if nothing in the tenant requires MFA.

Check which of these is in place:

  • Conditional Access policies that require MFA for all users (needs Microsoft Entra ID P1, included in Business Premium).
  • Security Defaults, the free alternative for tenants without P1.
  • Per-user MFA, the older setting. It still works but is harder to manage, and Microsoft recommends moving to Conditional Access.

If a Conditional Access policy only targets admins, staff are still exposed. Extend it to all users, excluding one or two emergency break-glass accounts that are monitored closely.

5. Old sign-in methods that skip MFA

Even with MFA required, older sign-in methods that can't show an MFA prompt may still accept a password. Block legacy authentication with Conditional Access, or rely on Security Defaults, which blocks it for you. The legacy sign-in guide covers this in detail.

Answering the question honestly

If any of these gaps exist, "partly" is the right answer, along with a plan and a date. An insurer can work with a plan. A "yes" that a claim later disproves is much harder to fix.

Check every account in one report. The Cyber Insurance Readiness Check reads MFA registration, admin methods and enforcement from the tenant with read-only access, and lists the accounts behind each answer.