Fix MFA Secure Score Not Complete After Conditional Access Policy in Entra ID
Question details
Microsoft Secure Score recommendations for multifactor authentication remain incomplete despite applying a Conditional Access policy for administrators.
- Product
- Microsoft Entra ID
- Device & OS
- not provided
- Scenario
- Improving the organization's security posture by enforcing MFA for administrators to meet Microsoft Secure Score recommendations.
- Observed behavior
- The Microsoft Secure Score evaluation does not update to show completion, even though an MFA Conditional Access policy has been enabled for administrators.
Keep in mind that Microsoft Secure Score evaluations are not real-time. It can take 24 to 48 hours for the score to update and reflect newly applied Conditional Access policies.
Verify Conditional Access Policy Conditions and Exclusions
Ensure the Conditional Access policy is configured correctly, actively enforced, and does not inadvertently exclude key administrative roles.
Secure Score carefully evaluates the exact parameters of your Conditional Access policies. If the policy is set to Report-only mode, or if critical administrative roles are excluded from the MFA requirement, the Secure Score recommendation will remain incomplete.
Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator. Browse to Protection, then select Conditional Access.
Select the specific policy designed to require MFA for administrators. Under the 'Users' section, confirm that all necessary administrative directory roles are targeted and that exclusions are kept to an absolute minimum (like break-glass accounts).
Scroll down to the bottom of the policy configuration page and ensure the 'Enable policy' toggle is set to 'On' rather than 'Report-only' or 'Off'.
If you made any changes, click 'Save'. Allow up to 48 hours for the Microsoft Secure Score engine to re-evaluate your tenant's security posture.
Validate Authentication Strength Requirements
Confirm that the authentication methods required by your policy meet the specific criteria outlined by the Secure Score recommendation.
Open a Microsoft Entra ID Support Request
Escalate the issue to Microsoft Support if the policy is correctly configured, fully enforced, and more than 48 hours have elapsed without a Secure Score update.
Need a Lightweight Alternative for Office Documents? Try WPS Office
While you are managing complex Microsoft 365 administrative and security policies like Entra ID Conditional Access, you might also be looking for a cost-effective, lightweight office suite for your daily document tasks. WPS Office provides a free, highly compatible alternative to Microsoft Office.
- 1. Download the Installer: Visit the official WPS Office website and click the free download button to get the setup file.
- 2. Install the Software: Run the downloaded installer and follow the simple on-screen instructions to install WPS Office on your computer.
- 3. Open Your Office Files: Launch WPS Office and directly open your existing Microsoft Office files with full layout and formatting compatibility.
Frequently Asked Questions
How long does Microsoft Secure Score take to update after changing a Conditional Access policy?
Microsoft Secure Score is not a real-time system. It typically takes 24 to 48 hours to process changes, analyze user telemetry, and reflect updated scores after a Conditional Access policy is created or modified.
Why is my MFA Conditional Access policy not improving my Secure Score?
The most common reasons include the policy being set to 'Report-only' mode, inadvertently excluding too many administrative users, or the system simply needing more time (up to 48 hours) to evaluate the enforcement.
Can I exclude break-glass accounts from my MFA policy without ruining my Secure Score?
Yes, Microsoft highly recommends excluding emergency access (break-glass) accounts from MFA Conditional Access policies to prevent accidental tenant lockouts. Secure Score logic generally accounts for these standard best-practice exclusions if configured correctly.
Does third-party MFA count towards fulfilling the Microsoft Secure Score recommendation?
If you are using a third-party identity provider or MFA solution, Microsoft Secure Score might not automatically detect the enforcement. In such cases, you can manually go to the Secure Score portal and mark the recommendation status as 'Resolved through third party'.
