The problem.
“MFA is enabled” does not mean everybody uses it, nor with a strong method. Measuring real coverage usually requires creating an app and a secret in the tenant, which many admins refuse for a simple audit.
What I built.
01
Web version (Node.js + PowerShell)
- Interactive sign-in through the official Microsoft Graph module, persistent PowerShell worker behind a local Express API.
02
Native Windows application
- Standalone .NET 10 (WPF) app: Microsoft sign-in through MSAL and the Windows WAM broker, external tenants supported.
- Dashboard for MFA, passwordless, FIDO2 passkeys, phishing-resistant methods and SSPR; admins without MFA and weak methods highlighted.
- Search, filters and CSV export; installer distributed through GitHub Releases.
The architecture.
AdministratorMicrosoft account
Entra Posture.NET · MSAL · WAM
Microsoft Graphdelegated · read-only
DashboardMFA · passwordless · SSPR
CSV exportaccounts to fix
Security & guardrails.
- Delegated, read-only Graph access.
- No embedded app secret, no local server, no Windows service.
The results.
- An authentication posture audit in minutes, without creating anything in the tenant.
