Created by Claude - please verify

Security defaults & per-user MFA - per-user state is read from a beta endpoint, one call per user.

Required Microsoft Graph permissions

Policy.Read.All UserAuthenticationMethod.Read.All User.Read.All — application permissions, granted to the app registration with admin consent.

Endpoints: GET /v1.0/policies/identitySecurityDefaultsEnforcementPolicy · GET /beta/users/{id}/authentication/requirements (scan)

The per-user scan reads every enabled member once (4 calls in flight) - expect a few minutes on large tenants.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Security Defaults & Per-user MFA Leftovers

Microsoft recommends Conditional Access instead of the legacy per-user MFA setting. Users still 'enabled' or 'enforced' for per-user MFA get prompted on every sign-in regardless of your CA policies, and the two systems together are hard to reason about. Security defaults, if on, cannot coexist with Conditional Access policies.

Security defaults

unknown

Protection comes from Conditional Access

Users with per-user MFA on

Run the scan below

Could not be read

Reads the per-user MFA state of 33 enabled members.