Require phishing-resistant MFA for admins

A code by text or an app approval can be relayed by a fake sign-in page. Passkeys, Windows Hello for Business and certificate-based MFA cannot. This checks that a Conditional Access policy makes admins use one of those for the same admin roles the admin MFA check covers.

A scan reports where your tenant stands on this check — pass, fail with a step-by-step fix, or not applicable if your licensing doesn’t include the feature. When Tenant Strike can’t read a setting with read-only access, it says unverified and gives you a one-command way to confirm it yourself — it never guesses.