Sign-in strength
How RevoSecure grades every account by its strongest MFA method, how the 0–100 score works, and how to raise it.
Updated
On this page
Sign-in strength grades everyone who can actually sign in by the strongest MFA method they have registered. It appears on the customer's Identity → Overview, as a filter on Identity → Users, and in every Microsoft 365 assessment.
Without Entra ID P1. Microsoft's MFA registration report needs Entra ID P1. When a tenant doesn't have it (for example Microsoft 365 Business Standard), the Microsoft 365 assessment reads each person's registered methods instead, administrators first and up to 1,000 people, so sign-in strength and "administrators without MFA" still work. Anyone whose methods couldn't be read is listed as not checked, never counted as having no MFA. The daily per-user view on Identity → Overview still comes from Microsoft's report, so there it needs P1.
Who is scored
Enabled member accounts. Not scored, but counted and shown (for example "12 shared mailboxes and 4 blocked accounts not counted"):
- accounts with sign-in blocked;
- guests (their MFA belongs to their home organisation);
- shared, room and equipment mailboxes (detected with the optional MailboxSettings.Read permission).
Tiers
A user's best registered method decides their tier.
| Tier | Methods | Points |
|---|---|---|
| Passkey / phishing-resistant | Security keys (FIDO2), passkeys, Windows Hello for Business, macOS platform credential | 100 |
| Authenticator app | Microsoft Authenticator (push or passwordless), software or hardware one-time passcodes | 90 |
| SMS / voice only | Mobile, alternate mobile or office phone | 40 |
| No MFA | None of the above. Email, temporary access pass, security questions and app passwords don't count as MFA | 0 |
Unknown method values never lift a user.
Score
The score is a weighted average of everyone's points, from 0 to 100. Administrators count five times as much as other members, so fixing admins first moves the score the most.
| Score | Rating |
|---|---|
| 90 and above | Good |
| 70–89 | Needs work |
| Below 70 | Weak |
A tenant where everyone uses Microsoft Authenticator scores 90 (Good), so a good score never needs hardware keys for every user. Passkeys, especially for administrators, add the rest.
Findings
| Finding | Severity | When |
|---|---|---|
| Administrators rely on SMS or voice | High | An admin's best method is SMS or voice |
| Administrators without phishing-resistant MFA | Low | Admins with an app but no passkey or Windows Hello (an advanced step) |
| Users rely on SMS or voice | Medium above 10% of active members, else low | Members whose best method is SMS or voice |
| SMS or voice enabled for all users | Low | The authentication methods policy allows them for everyone |
| Shared mailboxes can sign in | Medium | Shared, room or equipment mailboxes with sign-in enabled |
Users with no MFA at all are covered by the MFA registration findings instead, so nothing is counted twice. The findings resolve on their own when a later assessment no longer sees the problem.
How to improve
The check's details list the steps that apply, biggest gain first, with the exact portal steps:
- Run an Authenticator registration campaign (Entra ID → Authentication methods → Registration campaign).
- Give administrators passkeys (Authentication methods → Policies → Passkey (FIDO2)).
- Add a Conditional Access policy requiring the Phishing-resistant MFA strength for admin roles (report-only first).
- Turn off SMS and voice once users have moved.
- Block sign-in for shared mailboxes (Microsoft 365 admin center → Users → Active users → Block sign-in).
A customer's ideal state can set who must have MFA and the minimum strength required for administrators.