Most Microsoft 365 breaches now start with identity, not malware: device code phishing, adversary-in-the-middle kits that steal the session after MFA, and malicious apps users consent to. Twelve questions show whether your tenant would stop them.
Short answer: block the device code flow and legacy authentication with Conditional Access, require phishing-resistant MFA (FIDO2 or passkeys) for admins, restrict user consent to apps, require compliant devices for privileged access, and send Entra sign-in logs to a SIEM with alerts. Those six settings close the paths behind most current tenant takeovers.
Free, runs in your browser. Nothing you enter is sent or stored. Updated: .
0%
Gaps are ordered by how often they are used in real attacks. Where you answered "not sure", you also get how to check.
Gaps, by impact
Based on Microsoft guidance and public incident reporting in 2025 and 2026. A self-check is not a configuration review: settings can look right and still have exclusions that attackers find.
Questions
What is device code phishing?
The attacker starts a legitimate Microsoft sign-in that uses a device code, then tricks the victim into entering that code on the real microsoft.com/devicelogin page. The victim completes MFA and the attacker receives the tokens. Blocking the device code flow in Conditional Access stops it for users who don't need it.
Is Microsoft Authenticator push enough MFA?
It stops password-only attacks but not adversary-in-the-middle phishing, which relays the sign-in and steals the session cookie. Only phishing-resistant methods such as FIDO2 security keys, passkeys or Windows Hello for Business are bound to the real site.
Do I need Entra ID P2 for this?
Most items need only Entra ID P1, included in Microsoft 365 Business Premium and E3. Risk-based policies and Privileged Identity Management need P2 (E5 or the add-on); without them, compensate with SIEM alerts and fewer standing admins.
Our Microsoft 365 security audit reviews Conditional Access, app consent, admin roles and logging in your tenant, with every exclusion explained, and gives you a prioritised fix list.