Problem overview.
The challenge this resource is designed to solve.
Security gaps often arise when users overlook or disable multi-factor authentication on Windows devices. This monitor proactively identifies missing MFA configurations, helping IT teams address vulnerabilities before they escalate.
About this resource.
What it does and how it fits into your workflow.
This script runs every hour to evaluate key MFA-related security features on Windows workstations, such as Windows Hello for Business, biometric services, PIN enforcement, Secure Logon, and Azure AD join status. If it detects that fewer than two factors are enabled, it generates an alert signaling the device is not MFA-compliant. Once MFA is enabled or corrected, the alert automatically resolves without manual intervention.
| Monitor name | Monitor type |
|---|---|
| Windows MFA Check (Script monitor) | Windows MFA Check (Script monitor) |
| Windows Monitor - MFA Check | Run script |
Included with this resource.
Everything added when you import.
Scripts
- Windows Monitor - MFA Check
Use cases.
Common ways to put this resource to work.
- Confirming Windows devices meet organizational MFA standards
- Monitoring newly onboarded endpoints for MFA compliance
- Automating proactive remediation processes for non-compliant devices
- Integrating with broader security policies and compliance audits
Recommendations.
Practical guidance for a reliable rollout.
- Test Thoroughly: Always test this script in a controlled environment before deploying it across production devices.
- Pair with Automations: Create a follow-up automation that notifies end users or instructs them to enable MFA once the monitor generates an alert.
- Configure Policies: Ensure Windows Hello for Business, biometric, and PIN policies align with your organization’s security requirements.
- Set Clear Thresholds: Adjust the acceptable number of enabled factors in the script if your environment has unique compliance standards.