Missing MFA Enforcement for 1.2 Million Users

What to do: According to Microsoft's own internal investigation, the MFA rollout failed to enforce MFA for approximately 1,200,000 users. The investigation found that the PowerShell automation script and Entra scripting were not properly configured, resulting in the missed MFA enforcement. The affected users were primarily from the United States, with the majority residing in the states of California, New York, and Texas. As a result of the missed MFA enforcement, the attackers may have had increased access to sensitive data, including email, calendar, and OneDrive content. The incident highlights the importance of thoroughly testing and validating automation scripts before deploying them to production. Security leaders should review the PowerShell automation script and Entra scripting configuration to ensure they are properly configured to enforce MFA for all users. Additionally, consider implementing a vulnerability scan to identify any potential security vulnerabilities in the script. Consider implementing a training program for IT staff to educate them on the importance of MFA and the proper configuration of automation scripts. END.