MFA Coverage
The share of client user accounts enforced to use multi-factor authentication, with admin accounts tracked separately.
Formula
Accounts with MFA enforced ÷ Active interactive accounts × 100
Why Track It
Stolen credentials are how most account takeovers start, and MFA stops most of them. Coverage by client tells the vCIO which clients to push and gives evidence for cyber insurance questionnaires.
How It Is Measured
From each client's identity provider (such as Microsoft Entra ID or Google Workspace), count interactive user accounts where MFA is enforced by policy and registered. Divide by all active interactive accounts. Report admin and privileged accounts as a separate line, and count legacy authentication paths that bypass MFA as gaps. Also report the MSP's own staff accounts.
Constraints
Service accounts and shared mailboxes need a written exception rule or the number is meaningless. It does not show whether the MFA method resists phishing.
Measurement Note
Umbrex sets targets of 100% for privileged identities with zero legacy bypass and 95% or more of interactive workforce users enforced and registered. Registered is not enforced: an account that can still sign in without MFA is a gap.
Referenced In
- Shared Admin Accounts Are the First Thing to RemoveArticle
- Do I Need a SOC for My MSP?Answer
- How Do I Let Go of a Bad Client?Answer
- How Do I Price Security Services?Answer
- How Does HIPAA Apply to MSPs?Answer
- Should I Require Cyber Insurance From My Clients?Answer
- What Is a QBR, and Why Does It Matter?Answer
- What Is an MSP?Answer
- BYOD (Bring Your Own Device)Glossary Term
- MFA (Multi-Factor Authentication)Glossary Term
- QBR (Quarterly Business Review)Glossary Term
- vCIO (Virtual CIO)Glossary Term
- Zero TrustGlossary Term
Related KPIs
- Mean Time to Identify and Contain a BreachThe average days from the start of a confirmed security breach to its identification, plus the days from identification to containment.
- Patch Compliance RateThe share of managed endpoints with critical and high severity patches installed within the patch SLA.
- Phish-Prone PercentageThe share of client users who click a link, open an attachment or enter credentials in a simulated phishing test.
Glossary and Answers
More in Security Operations
Whether the basic controls an MSP runs for clients are actually in place and working. These numbers show how exposed the client base is to the breach that ends a client relationship.
- Backup Success RateCentralized Services Lead
- Mean Time to Identify and Contain a BreachSecurity Lead
- Patch Compliance RateCentralized Services Lead
- Phish-Prone PercentageSecurity Lead
- Restore Test Pass RateCentralized Services Lead