Liongard Library

Welcome to Liongard Library, where Lions share! This is a community-led space where Liongard users can come to teach and learn from one another.
Share custom Metrics, get inspired and see what’s trending in the Pride.

Pride Etiquette:
➕ Have great custom Metrics? Add them as entries!
🌟 Want to use a Metric? Copy the query and follow this doc.
👍 Tried a Metric from the Library? Like it!
📣 Have a question or feedback on a Metric? Add a comment!
🔎 Not sure where to start? Learn about Metrics and how to write them.
💬 Need help writing a metric or want to help support others? Join the conversation in our Liongard Lounge #metrics slack channel.


🥴 See something off? Open a support chat to let us know.

Add a new Metric entry Subscribe
Categories Microsoft 365
Created by Addison Caldwell
Created on Jun 7, 2021

RELATED METRIC

Office 365: Admin Users with MFA Disabled List

This is helpful to someone who's trying to obtain/maintain visibility into the admin users in an organization's M365 instance. This is a good Metric for QBRs, recurring site reviews, and an onboarding report. Also, this Metric could be used to build a user audit with the intention of an end customer confirming that all looks as expected. This Metric can also be used to create a pointed Actionable Alert that helps to maintain visibility into changes to the list of Admin users with MFA disabled.

Inspector Microsoft 365
Query
Users[? Privileged == `Yes` && isMfaRegistered_r == `Disabled`].displayName
  • Attach files
  • Ricky K
    Reply
    |     Mar 27, 2024

    Hi Guys,


    This is a metric what I have created perhaps is this also helpfull

    Users[?Privileged=='Yes' && (isMfaRegistered_r == 'Disabled' || isMfaRegistered_r == 'Unknown') && contains(AssignedRoles, 'Global Administrator')].userPrincipalName


    Goodluck!

  • John Larger
    Reply
    |     Apr 21, 2022

    We believe this requires a P1 license or greater to return valid data. I believe the data print returns 'Unknown' for this value otherwise.