Entra Policy Suite documentation · Verified against Entra Policy Suite 2.1.4 on Nov 11, 2026
Identity report views
The identity report has 45 views: 43 gap views with a severity and 2 full lists. 21 of them are the sheets of the Entra Policy Suite 1 report. See Identity report.
Lists
| View | Severity | What it means | How to close it |
|---|---|---|---|
| All users | - | Every user with every column. | - |
| All devices (Intune) | - | Every Intune managed device. The per-user device counts only count devices synced in the device window. | - |
MFA and authentication
| View | Severity | What it means | How to close it |
|---|---|---|---|
| Admins without MFA | High | Users with an admin role who are not registered for MFA. | Register MFA for each admin now (Temporary Access Pass + a passkey); until then they are one password away from a tenant takeover. |
| Admins without phishing-resistant MFA | High | Enabled admins without a passkey, FIDO2 key or Windows Hello for Business. | Give every admin a passkey (or FIDO2 key) and require phishing-resistant MFA for admin roles in Conditional Access. |
| Active without MFA | High | Enabled users (not guests, not FIDO / password-only / WHfB tagged) who are not registered for MFA - except new hires starting after the grace period. | Have them register MFA; if they cannot, check their Authentication tag. |
| No MFA, but a company smartphone | High | Enabled users (no mailbox, or a user mailbox / mail user) who are not registered for MFA, with a company iPhone or Android synced in the device window - they can register Authenticator today. | Ask them to register the Authenticator app on their company phone. |
| MFA by phone or mail only | Medium | Enabled users whose only registered methods are SMS, voice or e-mail - the methods SIM swap and phishing defeat. | Move them to the Authenticator app or a passkey, then disable SMS / voice in the authentication methods policy. |
| Cannot do MFA | Medium | Enabled user accounts (not guests, not shared / room mailboxes) with no method that can satisfy MFA. | Register a method, or tag the account for what it is (service account, shared mailbox) so the right policy applies. |
| MFA users - compliant | Info | MFA-tagged users (not guests) registered for MFA and SSPR, with Authenticator push or Windows Hello. | - |
| MFA users - not compliant | Medium | MFA-tagged users (not guests) not registered for MFA, not for SSPR, or with neither Authenticator push nor Windows Hello. | Have them complete the combined registration (Authenticator + SSPR). |
| Passkey users - compliant | Info | FIDO-tagged users with a device-bound passkey. | - |
| Passkey users without a passkey | High | FIDO-tagged users without a device-bound passkey - the policy for them expects one. | Issue a Temporary Access Pass and have them register a passkey. |
| SSPR on, not registered | Low | Enabled users who may reset their own password but have not registered for it - they call the help desk instead. | Use the registration campaign (or combined registration) to collect it. |
| System-preferred MFA off | Low | MFA-registered users for whom Entra does not pick the strongest method at sign-in. | Enable system-preferred MFA in the authentication methods policy. |
Sign-in and lifecycle
| View | Severity | What it means | How to close it |
|---|---|---|---|
| No sign-in for 90 days | Medium | Enabled users of the active classifications with no sign-in (cloud nor AD) in the inactivity window. | Confirm with the manager, then disable; delete after your retention period. |
| No sign-in for a year | High | Enabled users of the active classifications with no sign-in (cloud nor AD) in the long inactivity window - almost certainly orphaned. | Disable now; delete after your retention period. |
| Never signed in | Medium | Enabled users created more than the inactivity window ago who have never signed in (cloud, non-interactive nor AD). | Find out why it exists; disable it if nobody claims it. |
| Signs in to AD only | Low | Enabled users with an AD sign-in but never a cloud sign-in - candidates to stop syncing to the cloud. | Scope them out of the Entra Connect sync (fewer cloud identities to protect). |
| Password never expires | Low | Enabled users whose password never expires, in Entra or in AD. | Fine with passwordless / strong MFA; otherwise make sure the password is long and unique, or move the account to a managed identity. |
Licenses
| View | Severity | What it means | How to close it |
|---|---|---|---|
| Disabled but licensed | Medium | Disabled users who still hold licenses. | Remove the licenses (or convert the mailbox to shared) - it is money spent on nobody. |
| More license than needed | Low | Users holding a license their classification does not need (the license rules). | Assign the license the classification needs instead. |
| Missing the license they need | Medium | Users without the minimum license their classification needs - features the policies rely on may not apply to them. | Assign the minimum license (group-based licensing by classification). |
Guests
| View | Severity | What it means | How to close it |
|---|---|---|---|
| Guests without a recent sign-in | Medium | Enabled guests with no cloud sign-in in the guest inactivity window. | Remove them, or run an access review on guests. |
| Guests with an admin role | High | Guest accounts that hold an admin role - an outside identity you do not manage. | Remove the role, or replace the guest with a managed account (or PIM-eligible with approval). |
| Guests with a license | Low | Guest accounts with an assigned license. | Check it is needed; most guests need none. |
Tagging coverage
| View | Severity | What it means | How to close it |
|---|---|---|---|
| No Classification tag | Medium | Enabled users without a Classification - the Conditional Access policies that target classifications do not see them. | Add a rule (Rules page) that classifies them, or a fallback on the tag type. |
| No Authentication tag | Medium | Enabled users without an Authentication tag - no authentication policy targets them. | Add a rule (Rules page) for their authentication method. |
| Cloud users missing HR data | Low | Enabled cloud-only users (not guests) without a mobile phone, department or usage location - v1 computed it, now a view. | Fill the fields from HR, or check whether the account is a real person. |
AD hygiene
| View | Severity | What it means | How to close it |
|---|---|---|---|
| Disabled in AD, enabled in Entra | High | AD-synced users disabled in AD but still enabled in Entra - the sync has not caught up, or the account was re-enabled in the cloud. | Check Entra Connect; disable the cloud account. |
| Expired in AD, still enabled | High | AD accounts past their expiry date that are still enabled in Entra - an expiry in AD does not stop a cloud sign-in. | Disable the account (Entra and AD). |
| Locked out in AD | Info | AD accounts that are locked out right now - a password spray shows up here first. | Look for a pattern (many at once = an attack). |
| AD users in the right OU | Info | AD-synced users (by Authentication tag) whose AD location matches the user OU pattern. | - |
| AD users in the wrong OU | Low | AD-synced users (by Authentication tag) whose AD location does not match the user OU pattern - GPOs and delegation meant for users miss them. | Move them to the user OU (or fix the pattern in Settings). |
| Shared device users in the right OU | Info | AD-synced shared device users whose AD location matches the user OU pattern. | - |
| Shared device users in the wrong OU | Low | AD-synced shared device users whose AD location does not match the user OU pattern. | Move them to the right OU. |
| Service accounts in the right OU | Info | AD-synced service accounts whose AD location matches the service account OU pattern. | - |
| Service accounts in the wrong OU | Medium | AD-synced service accounts outside the service account OU - their hardening GPOs do not apply. | Move them to the service account OU. |
| Shared mailboxes that can sign in | Medium | Shared mailbox accounts that are enabled - nobody should sign in to a shared mailbox. | Block sign-in on the account (the mailbox keeps working). |
Devices
| View | Severity | What it means | How to close it |
|---|---|---|---|
| Personal smartphone only | Info | Enabled users whose only active smartphones are personal (BYOD). | Check app protection policies cover them. |
| Non-compliant devices | High | Managed devices Intune reports as not compliant. | Fix the failing settings; a compliant-device policy in Conditional Access blocks them meanwhile. |
| Devices with active malware | High | Windows devices with active malware reported. | Isolate and remediate in Defender for Endpoint. |
| Jailbroken or rooted devices | High | Devices Intune reports as jailbroken / rooted. | Retire the device from management; block it with a compliance policy. |
| Devices not encrypted | Medium | Managed devices that report no disk encryption. | Enforce BitLocker / FileVault / device encryption with a compliance policy. |
| Stale devices | Low | Managed devices that have not synced in the device window. | Retire / delete devices not used any more (Intune device clean-up rules). |
| Devices without a user | Low | Managed devices with no primary user. | Set the primary user, or confirm it is a shared / kiosk device. |
Ready-made pivots
- MFA strength by classification
- Last sign-in by classification
- License fit by classification
- Authentication tag vs MFA strength
- Devices by platform and ownership
- Device compliance by platform
Verified against Entra Policy Suite 2.1.4 on 2026-11-11
Verified against Entra Policy Suite 2.1.4 on Nov 11, 2026