> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/modules/secure/alerts/monitored-alerts/dedicated-posture-alerts.md).

# Dedicated Posture Alerts

These are standalone security-posture alerts that fire on a specific configuration check, separate from the broader Posture Drift Alerts catalog. Each runs the same way: Augmentt checks the relevant setting once a day and fires only on a compliant-to-non-compliant transition — a regression, not a one-time snapshot or a sweep of everything that's already non-compliant.

| Alert                                                       | Category         | Severity |
| ----------------------------------------------------------- | ---------------- | -------- |
| **Admin MFA** `office365_posture_admin_mfa`                 | Security Posture | High     |
| **User MFA** `office365_posture_user_mfa`                   | Security Posture | Medium   |
| **Block Legacy Auth** `office365_posture_block_legacy_auth` | Security Posture | Medium   |

## Admin MFA / User MFA

Microsoft attributes 99.9% of account-compromise attacks to the absence of MFA. These two alerts watch a client's overall MFA-required posture for regressions, wherever they happen.

Augmentt runs a daily comparison and fires specifically when a user's **MFA required** state moves from compliant to non-compliant — deliberately not based on MFA *enrollment* status. That distinction is intentional: as an MSP, you control whether MFA is enforced for a client, but you generally don't control whether an individual user has personally enrolled a method yet. A user who's enrolled but not required to use MFA is still a real risk, so tracking the requirement — the thing you can actually act on — is the more useful signal.

**Admin MFA** and **User MFA** are the same check scoped to admin accounts versus regular user accounts, which is why Admin MFA carries a higher default severity.

## Block Legacy Auth

Legacy authentication protocols (like older POP, IMAP, and SMTP clients) don't support modern MFA challenges — so an attacker with a stolen password can use legacy auth to bypass MFA entirely, even on an account that otherwise requires it. This is the same 99.9%-of-attacks MFA statistic at work: MFA only protects you if nothing can route around it.

This alert watches for a client's legacy authentication blocking posture regressing — that is, a tenant that used to block legacy auth no longer does. Augmentt runs a daily comparison and fires only on a compliant-to-non-compliant transition, not simply whenever a new user is added to a tenant that already allows legacy auth. That distinction matters in practice: service accounts and legacy integrations often need legacy auth deliberately, and alerting on every new user in that situation would just be noise. What's worth flagging is a tenant's protection actually getting worse.

## Setting it up

Enable and configure recipients for each of these alert types from **Secure > Alerts > Settings**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://helpdesk.augmentt.com/modules/secure/alerts/monitored-alerts/dedicated-posture-alerts.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.