AD / Microsoft 365 hygiene report

Collected 2026-09-30T12:00:00Z · corp.internal / corp.example

Summary

Check	Title	Result
AD-01	Stale users	2 finding(s)
AD-02	Stale computers	1 finding(s)
AD-03	Passwords that never expire	2 finding(s)
AD-04	Privileged group membership	2 finding(s)
AD-05	Kerberoastable users	2 finding(s)
AD-06	AS-REP roastable users	1 finding(s)
AD-07	Unconstrained delegation	2 finding(s)
M365-01	Users without MFA	2 finding(s)
M365-02	Unused licenses	3 finding(s)
M365-03	Global Administrator count	1 finding(s)
M365-04	Permanent privileged roles	Not evaluated
M365-05	Stale guests	2 finding(s)

Disable accounts that no longer log on, then delete them after your retention period. Reference

Severity	Status	Type	Identity	Detail
Medium	Finding	User	bob.old	Last activity 140 days before collection.
Medium	Finding	User	contractor.never	Never active; created 200 days before collection.

Disable computer accounts that no longer authenticate, then remove them. Reference

Severity	Status	Type	Identity	Detail
Low	Finding	Computer	PC-OLD-17	Last activity 180 days before collection.

Remove PasswordNeverExpires; move service accounts to gMSA. Reference

Severity	Status	Type	Identity	Detail
Medium	Finding	User	svc-sql	PasswordNeverExpires is set.
Medium	Finding	User	svc-backup	PasswordNeverExpires is set.

Keep privileged groups small; remove disabled and inactive members. Reference

Severity	Status	Type	Identity	Detail
Medium	Finding	User	former.admin	Disabled account is still a member (Domain Admins > former.admin).
Medium	Finding	User	bob.old	Inactive member (Backup Operators > bob.old). Last activity 140 days before collection.

Move services to gMSA or use long random passwords; remove SPNs that are not needed. Reference

Severity	Status	Type	Identity	Detail
Medium	Finding	User	svc-sql	SPN: MSSQLSvc/sql01.corp.internal:1433
High	Finding	User	svc-backup	SPN: HTTP/backup01.corp.internal; member of Domain Admins.

Re-enable Kerberos pre-authentication. Reference

Severity	Status	Type	Identity	Detail
High	Finding	User	legacy.app	Kerberos pre-authentication is disabled.

Replace unconstrained delegation with constrained or resource-based constrained delegation. Reference

Severity	Status	Type	Identity	Detail
High	Finding	Computer	APP01	Trusted for unconstrained delegation.
High	Finding	User	svc-web	Trusted for unconstrained delegation.

Require MFA registration (registration campaign or Conditional Access). Reference

Severity	Status	Type	Identity	Detail
Medium	Finding	User	bob@corp.example	No MFA method registered.
Medium	Finding	User	dave@corp.example	No MFA method registered.

Reclaim licenses from disabled and inactive users; reduce unassigned seats at renewal. Reference

Severity	Status	Type	Identity	Detail
Low	Finding	License	ENTERPRISEPREMIUM	6 of 10 seats unassigned.
Medium	Finding	User	carol@corp.example	Licensed but the account is disabled.
Low	Finding	User	dave@corp.example	Licensed but inactive. Last activity 120 days before collection.

Keep between two and four Global Administrators, including break-glass accounts. Reference

Severity	Status	Type	Identity	Detail
Medium	Finding	Tenant	Global Administrator	1 active Global Administrators; expected 2 to 4.

Convert standing assignments to PIM-eligible assignments. Reference

Severity	Status	Type	Identity	Detail
Info	Not evaluated	Check		Not evaluated: graph.roleEligibility unavailable: The tenant needs a Microsoft Entra ID P2 license..

Review guests with access reviews; remove inactive guests and expired invitations. Reference

Severity	Status	Type	Identity	Detail
Low	Finding	Guest	partner_fabrikam.test#EXT#@corp.example	Last activity 95 days before collection.
Low	Finding	Guest	pending_contoso.test#EXT#@corp.example	Invitation pending 45 days.