MFA coverage

“See who can still sign in without phishing-resistant MFA across Entra ID, Okta and Google, plan the rollout and raise fix tickets.”

MFA Coverage app on demo data, Home page: 29% of 399 accounts protected by phishing-resistant MFA against a goal of 90%, a breakdown of protected, can fall back, phishable and no-MFA accounts, next steps, what weak accounts can reach and how people sign in

Pages: Home, Fix list, Rollout planner, People, and Admin roles & apps, plus Matching, Knowledge Base and Settings, which every pre-built app has.

What it includes

Item	Type
MFA Coverage Template	Studio app
MFA Template Microsoft Entra ID Sign-in Methods	Data feed
MFA Template Okta Sign-in Methods	Data feed
MFA Template Google Workspace Sign-in Methods	Data feed
MFA Template People BambooHR	Data feed
MFA Template Raise Fix Ticket	Action
Claude AI	Action
Template Claude Link Matcher	Action

What you need

To import, you need credentials for Entra ID, Okta, Google Workspace and BambooHR, your ITSM details, and an Anthropic API key.

Add it to your workspace

In Builder Mode, open Build Apps, find MFA coverage in the Gallery and click Import. See Introduction for the full steps and what happens when you import.

Build a starting version yourself

Want to build something like it from scratch instead? Paste this into the Planner, which turns it into ready-to-launch prompts for each data feed, action and app. You can also paste it straight into the Studio Composer.

Build an MFA coverage app that shows who can still sign in without phishing-resistant MFA and plans the rollout.

Data: sign-in methods from Microsoft Entra ID, Okta and Google Workspace, and people from our HR system.

Pages:
- Home: the share of accounts protected by phishing-resistant MFA against a target date, split into protected, can fall back to a weaker method, phishable MFA and no MFA. Show what admin roles and sensitive apps weak accounts can reach, and how people sign in by method.
- Fix list: every account with a gap, admins and sensitive access first.
- Rollout planner: who to enrol next and how each step moves the total.
- People: every person with their accounts and methods.
- Admin roles & apps: who holds each admin role and sensitive app, and whether they're protected.

Add an action that raises a ticket to fix an account.

This won’t recreate the pre-built app exactly. The Composer generates a new app each time, so the same prompt gives a different result every run, even twice in the same session. Treat it as a starting point and refine it in conversation. To get the app exactly as shown on this page, import it from the Gallery.

Use cases

Pre-built Apps

Tutorials

What it includes

What you need

Add it to your workspace

Build a starting version yourself