Skip to content

The admin portal#

The portal has six sections. The Overview always shows one suggested next step at the top, with the campaign journey under it.

Try it

The live demo is the real portal with a made-up company in it.

Overview#

  • The next step: a batch waiting to be sent, people to review, or nothing to do.
  • The journey: make it yours, find people, send invitations, follow up, phishing-resistant, with where you are.
  • Headline numbers, the progress funnel (in the campaign, invited, opened their link, have MFA that counts, added a passkey, done) and a needs attention list that links to the people concerned.
  • The whole tenant by the strongest way people can sign in, from that morning's count.
  • Under it, Windows Hello for Business on its own bar: everyone with Windows Hello (or a Mac device key) on at least one computer, whatever else they have.

Windows Hello isn't coverage

Windows Hello protects one computer only, so it's deliberately kept apart from the coverage figures. A tenant can be 90% on Windows Hello and still have most people without a passkey or Authenticator.

Find people#

Scan your tenant sorts every enabled, licensed member account by how it signs in today:

Group What happens if you import them
SMS or voice only The priority: SMS can be intercepted. They use SMS to prove themselves when they register.
Code app, not Authenticator Asked to switch to Microsoft Authenticator, then add a passkey.
Nothing registered Highest risk. They register with their password, so protect registration if you can.
Windows Hello only Protected on one computer only, so still asked for a passkey.
Authenticator push or token Already have MFA. Import them in their own batches to move them to passkeys.
Passkey or passwordless Already strong. Nothing to do.

Privileged accounts, guests, accounts that can't sign in, unlicensed accounts and people already in the campaign are left out, and the page says how many. Use View to see a group, filter it and pick individual people; Download gives you the list as CSV.

The import form has three parts:

  1. Who: everyone in the ticked groups, or the people you picked in a list.
  2. Into: a new batch (named by you) or an existing one. Adding people to a batch that's already been sent invites them straight away.
  3. When: send each batch yourself, or send the first now and the rest every few days, skipping weekends if you like, in batches of a size you choose.

Nobody is emailed by importing alone unless you chose a schedule or an already-sent batch. You can also upload a CSV with a UPN, UserPrincipalName or Email column.

Batches#

Each batch shows its progress (done, in progress, not sent, errors, exceptions) and when it was sent. Send invitations asks you to confirm, then emails go out within five minutes.

People#

Everyone in the campaign, searchable and filterable by status, batch and step. Click a person for their details and timeline: invited, opened the email, opened the link, registered, promoted. From there, or by ticking several:

  • Re-send a fresh link (the old one stops working).
  • Check now: re-read their methods from Entra instead of waiting for the hourly run.
  • Mark as an exception, with a reason and a review date. No more emails; still checked.
  • Remove from campaign.

Export CSV downloads the list, with spreadsheet formulas neutralised.

Reports#

A sign-in security report for leadership:

  • the headline, and the share of people on each kind of sign-in with the change since last week;
  • a 30-day trend;
  • Windows Hello on its own bar, not counted as coverage;
  • the campaign funnel and progress by batch.

Preview it here, Download PDF (two A4 pages, through your browser's Save as PDF), or have it emailed every day or every week to a list of addresses and the members of a group.

Settings#

Your company name, support team and email, brand colour, logo and the wording of invitations and reminders, with a live preview. {CompanyName} and {FirstName} are filled in for each person. Send test to me sends you a real one.

The About panel shows the posture, the passkeys the install accepts and the version.