Identity & MFA Readiness Assessment
A guided assessment of your organization's MFA coverage, Conditional Access policy, privileged access practices, passwordless readiness, SSO/federation, and identity lifecycle governance across six areas. No tenant access required.
Free to use · no account required
Identity Assessment
Work through each section at your own pace. All questions include operational context and specific next steps. Results are shown immediately — no email required.
Identity & Access Tool
Identity & MFA Readiness Assessment
A guided review of your organization's MFA coverage, Conditional Access policy, privileged access practices, passwordless readiness, SSO/federation, and identity lifecycle governance across six areas. Work through each section at your own pace — results are shown immediately.
How It Works
What this tool does with your input
How this tool works, and what happens to what you enter
- You
You answer scoped questions
Short, concrete questions about how your environment is actually configured — not a quiz.
- The tool
Scoring runs in your browser
Your answers are evaluated locally against a published baseline — no tenant access, no agent, no connection to your systems.
- You
You get a prioritised gap list
Where you stand by area, with the sequence to address it.
What To Look For
Six Indicators of Identity Risk
These are the most common gaps found in identity and authentication reviews — often hiding behind a nominal 'MFA is enabled' status.
Partial MFA Coverage
Any unprotected account — not just administrative ones — is a viable foothold for an attacker, and privilege can often be escalated from there.
Legacy Authentication Left Enabled
Legacy protocols bypass MFA entirely and are a common, quiet gap behind an "MFA is enabled but we still got compromised" incident.
No Break-Glass Account
Without an account excluded from Conditional Access policy, a single misconfiguration can lock out every administrator simultaneously.
Standing Privileged Access
An administrative account privileged 24/7 is a full-time high-value target — just-in-time activation shrinks that exposure window significantly.
Delayed Offboarding
A departed employee retaining active credentials, even briefly, is one of the most frequently cited findings in security and compliance reviews.
Local Password Fallback Left Enabled
An application still reachable via local password after SSO rollout is a bypass path around every centralized policy you have configured.
What This Assessment Covers
Six Areas of Identity & Authentication Maturity
Each section addresses a distinct dimension of identity security — from MFA coverage to lifecycle governance.
MFA Coverage
Whether MFA is enforced for all users, legacy authentication is blocked, and high-value accounts use phishing-resistant methods.
Conditional Access
Whether context-aware access policies are enforced, tested in Report-only mode first, and protected by a break-glass account.
Privileged Access
Whether administrative privilege is time-boxed (just-in-time) rather than standing, and reviewed on a recurring schedule.
Passwordless & Passkey Readiness
Whether passkey/FIDO2 authentication is enabled, with a documented fallback plan and tested device-recovery process.
SSO & Federation
Whether SSO covers the majority of applications, local password fallback is disabled, and federated trust is reviewed.
Identity Lifecycle Governance
Whether onboarding, role changes, and especially offboarding follow a defined, reliable, same-day process.
FAQ
Common Questions
Does this tool access my identity platform or tenant?
No. This is a structured self-assessment questionnaire — it does not connect to Microsoft Entra ID, Okta, or any other identity platform. You answer each question based on your organization's current practices, and results are shown immediately.
How is this different from the M365 Governance Assessment?
The M365 Governance Assessment covers Microsoft 365 posture broadly — identity, email security, backup, and retention. This assessment goes deeper specifically on identity and authentication: MFA method strength, Conditional Access rollout discipline, privileged access (PIM), passwordless readiness, SSO/federation coverage, and joiner-mover-leaver governance — relevant regardless of which identity platform you use.
We already have MFA enabled — why would we still score gaps here?
"MFA is enabled" and "MFA is enforced everywhere, with a phishing-resistant method, for every account including legacy protocols" are very different postures. This assessment is designed to surface exactly that kind of gap between nominal and actual coverage.
Is Privileged Identity Management (PIM) required to score well on the privileged access section?
PIM is the Entra ID-specific tool for just-in-time privileged access, but the underlying principle — minimizing standing administrative privilege — can be approximated manually even without PIM licensing, through a disciplined, scheduled review of standing role assignments.
How often should this assessment be repeated?
Annually at minimum, and after any significant identity-platform change — a new Conditional Access rollout, a new SSO integration, or a shift in MFA method strategy — since these are the events most likely to introduce or close a gap.
Related Identity & Access Guidance
The full topic hub — articles, diagrams, and downloads on authentication, MFA, SSO, and privileged access.
Broader Microsoft 365 posture assessment covering identity, email security, backup, and retention.
Go deeper on passkey/FIDO2 adoption readiness if that gap surfaced above.
Conditional Access, MFA rollout, and identity platform configuration.
Full identity and access posture review, from MFA coverage to privileged access governance.
Operational Support
Need help closing identity and access gaps?
IT KORR can design and implement Conditional Access policy, roll out phishing-resistant MFA, configure Privileged Identity Management, and build the joiner-mover-leaver process that keeps identity governance reliable as your organization grows.
No commitment required — we respond within one business day.