mfa coverage auditor

Measure MFA coverage from Entra, Google Workspace, Okta or any CSV/JSON user export; find admins without MFA and SMS-only users.

Measure multi-factor authentication coverage from a user export from Microsoft Entra / Microsoft 365, Google Workspace, Okta, JumpCloud or any SaaS admin page (CSV or JSON). Columns are auto-detected. Finds admins without MFA, users without MFA, stale accounts, SMS-only users (a NIST "restricted" authenticator) and admins without phishing-resistant keys, and writes a coverage report, a gap list CSV and a rollout plan. Use when someone asks "who doesn't have MFA?", "prove we enforce MFA" or "audit our 2FA".

What it does

• Runs entirely offline in standard-library Python (no network, no credentials, writes only inside the working folder).
• Ships with examples, unit tests (run on Python 3.8 / 3.9 / 3.13) and a references/sources.md citing the official specs used.
• Exit codes: 0 = clean / aligned, 1 = findings, 2 = bad input — ready for CI and agent loops.

Who it's for

Security-minded developers, MSPs, small-business IT, compliance leads and IR analysts who want a repeatable offline check their agent can run.

Not legal advice / limits

See the skill's references/sources.md and Known Limitations below. Compliance-flavored output is a draft for counsel, not a certification.