# dafthack/MFASweep

A tool for checking if MFA is enabled on multiple Microsoft Services

Repository: https://github.com/dafthack/MFASweep
Canonical: https://ross.abutalabs.com/products/mfasweep
Language: PowerShell
License: MIT
License Family: permissive
Last push: 2026-04-13T17:19:09+00:00

## Health v2 (maintenance only)
Score: 67/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 77, release rhythm 35, longevity 100
- inputs: {"age_days": 2171, "days_push": 142, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1692, forks 229 (observed 2026-08-28T04:05:22.726369+00:00)

## What it is
MFASweep is a PowerShell script that attempts to log in to multiple Microsoft services with provided credentials to detect whether MFA is enforced on each. It covers Graph API, Azure Resource Manager, Exchange Web Services, the M365 web portal with various user agents, Active Sync, and on-prem ADFS.

## Use cases
- check if MFA is enabled across Microsoft services for an account
- find Microsoft services left single-factor due to conditional access gaps
- audit MFA inconsistencies in a Microsoft 365 tenant
- test whether ADFS allows single-factor login
- pentest Azure AD accounts for MFA bypasses
- verify conditional access policy coverage per protocol

## When to choose
- you have authorized credentials and need to audit MFA enforcement across Microsoft services
- you are doing a security assessment of an Azure AD/M365 tenant
- you want to detect protocols bypassing conditional access policies

## When to avoid
- you lack authorization to test the target account (account lockout and legal risk)
- you need a continuous MFA monitoring solution rather than a point-in-time check
- you need non-Microsoft identity provider coverage

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, penetration-testing, auth, cli
- domain: security, penetration-testing, cloud-computing
- platform: windows, cli, cross-platform
- tags: mfa, microsoft-365, azure, adfs, conditional-access, red-team, powershell

## Member repositories
- dafthack/MFASweep (main) score 67

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:22.726369+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:38:13.323263+00:00, confidence not recorded.
  - readme: https://github.com/dafthack/MFASweep (fetched 2026-08-28T04:05:22.726369+00:00, sha 52dcc6cd40b0)
- Data as of 2026-08-30T08:39:29.467469+00:00.