How to Track MFA Exceptions Across Tenants Without Losing Control Multifactor Authentication is one of the strongest identity controls available. However, unmanaged MFA exceptions can introduce significant security risk. Across multiple tenants, they can become silent, long-standing security gaps. In this video, we'll walk through how to build a governance layer around MFA exceptions. Before we begin, be sure to subscribe to NinjaOne's IT Video Hub and our YouTube channel for more tech content like this. How to Track MFA Exceptions Step 1: Define What Qualifies as an MFA Exception Before you track anything, you need clear definitions. Common MFA exception categories include: Break-glass emergency accounts, Legacy application connectors, Temporary administrative exclusions, External trusted guest identities. For each category, define who can approve the exception, how long it remains valid, and what compensating controls or review requirements apply. Step 2: Identify Existing Exceptions Using Entra Workbooks Once categories are defined, the next step is visibility. Microsoft Entra Workbooks can help you Detect accounts accessing resources without MFA, Visualize inconsistencies across Conditional Access and Security Defaults, Surface enforcement gaps on a per-tenant basis. Run the MFA Gaps Workbook in each tenant. You're looking for inconsistencies, especially users excluded from Conditional Access policies. Step 3: Tighten Conditional Access Scoping Now that you've identified exclusions, refine how they're implemented. Avoid broad "exclude specific users" rules unless absolutely necessary. Instead, focus on limiting exclusions, requiring privileged authentication from secure workstations for excluded users, and avoiding broad exclusion rules wherever possible. Ultimately, exceptions should be narrowly scoped and justifiable. If exclusions can't be clearly explained in documentation, they shouldn't exist. Step 4: Track MFA Status Programmatically Use Microsoft Graph to inspect MFA registration and authentication methods. Here's a short example. Replace [email protected] with the actual UPN you're auditing. This command shows which authentication methods are configured for that user, helping you verify MFA registration and determine whether appropriate authentication methods are in place. For the complete script and expanded reporting logic, refer to the full blog post. Step 5: Automate Multi-Tenant Conditional Access Exception Reporting When you manage multiple tenants, manual review becomes unmanageable very quickly. Instead, automate the extraction of Conditional Access policies that exclude users and consolidate them into a single report. Here's a simplified example of the script: Be sure to replace the sample GUIDs with your real tenant IDs. You can retrieve them using: This approach provides centralized visibility into Conditional Access exclusions across tenants, helping you identify high-risk MFA exceptions more efficiently. Step 6: Establish a Formal Review and Rotation Schedule Exceptions should be time-bound whenever possible. Implement a structured cadence that incorporates: monthly or quarterly exception reviews, automatic expiration or alerting on approaching deadlines, mandatory re-approval for renewal. Step 7: Maintain a Central Governance Register Finally, document everything. Maintain a centralized register that includes tenant name, excluded users, Conditional Access policy name, date added, expiration or review date, reviewer notes. Store this in a secure, access- controlled location, ideally one that's integrated with your PSA or Microsoft 365 environment. When you define exception categories, tighten Conditional Access scope, automate reporting, maintain a governance register, and enforce scheduled reviews, you shift from reactive cleanup to proactive identity governance. For more information, check out our official blog post on how to track MFA exceptions across tenants, linked in the description below.