SurePassID Compliance Manager Report Interpretation and Remediation Guide

SurePassID Authentication Server

SurePassID Compliance Monitoring - Report Interpretation & Remediation Guide

This guide explains how to read each report produced by the SurePassID Compliance Manager, what findings mean, and what actions to take.

1. Privileged Authentication Report

Purpose: Shows every authentication event by privileged users (Domain Admins, Enterprise Admins, etc.) during the reporting period.

Key Fields

Summary Section

What to Look For

• SfaEvents > 0 — A privileged user logged in with password only. This is a compliance finding.
• MfaCoverageGaps > 0 — Windows logons occurred without a corresponding SurePassID MFA validation. Either MFA isn't installed on that machine or isn't being enforced.
• AuthFactors = Unknown — The system couldn't determine if MFA was used. Investigate the raw event.

Per-User Summary

Each user gets a breakdown showing their MFA vs SFA ratio and coverage rate. Users with SfaEvents > 0 or MfaCoverageGaps > 0 need attention.

2. SFA vs MFA Summary Report

Purpose: High-level view of MFA adoption across all users (privileged and non-privileged) with trend data.

Sections

What to Look For

• PrivilegedUsersOnly.SfaPercentage > 0 — Privileged users are still using password-only authentication.
• Declining MFA percentage in DailyTrend — MFA adoption may be regressing. Investigate if tokens were disabled or removed.
• MethodBreakdown — Shows which MFA methods are in use. A healthy environment should show modern methods (Push, FIDO2). Overreliance on SMS may indicate a security gap.

3. Privilege Drift Report

Purpose: Identifies privileged users whose MFA posture has drifted from the expected baseline — they should have MFA but something is wrong.

Drift Categories

Key Metrics

Recommendations

The report includes a Recommendations section with specific, actionable steps. These are generated based on the actual findings and are prioritized by severity.

4. MFA Coverage Analysis

Purpose: Cross-source verification. For every privileged Windows logon (SFA), the system looks for a corresponding SurePassID MFA validation event within a configurable time window.

How It Works

1. A privileged user logs into Windows (Event ID 4624) — this is an SFA event
2. The system searches SurePassID events for an MFA validation (OTP, Push, FIDO2, etc.) by the same user within ±N minutes
3. If found, the logon is marked MfaVerified; if not, it's marked NoMfaCoverage (a gap)

Coverage Statuses

Match Methods (from strongest to weakest)

Configuration That Affects Results

5. Understanding MFA Coverage Gaps

When the report shows MfaCoverage: NoMfaCoverage, it means a privileged user logged into Windows but no MFA event was found. This is the most important finding to investigate.

Common Causes

Debug Logging

Run with --verbose or set "Logging": { "LogLevel": { "Default": "Debug" } } to see detailed correlation decisions:

[MFA-GAP]  Event winlog-DC01-59344656 by 'DOMAIN\admin' NO MFA COVERAGE
            Windows:   UTC=2026-05-13 03:54:46 Local=2026-05-12 20:54:46 IP=192.168.50.154
            Searched:  names=[DOMAIN\admin, admin], window=±5min, requireIp=True
            Reason:    MFA event SP-118AB7B5 matched by username+time (delta=00:00:10) but IP mismatch: Windows=192.168.50.154 vs MFA=70.125.9.165 (RequireIpMatch=True)
            FindUser:  user resolved (LoginName=admin, Email=admin@company.com)

The Reason line tells you exactly why the match failed.

6. SFA-Only IP Address Analysis

Question: Which machines/IPs are allowing privileged users to log in without MFA?

The Privileged Authentication Report contains the data to answer this. Look at events where:

• AuthFactors = Sfa or MfaCoverage = NoMfaCoverage
• The IpAddress field identifies the machine

How to Extract SFA-Only IPs from the Report

From the JSON report output, filter for gap events:

# Parse the JSON report and find IPs with MFA coverage gaps
$report = Get-Content "Output\PrivilegedAuthReport.json" | ConvertFrom-Json
$sfaIps = $report.Events |
    Where-Object { $_.MfaCoverage -eq "NoMfaCoverage" } |
    Group-Object IpAddress |
    Sort-Object Count -Descending |
    Select-Object @{N="IP";E={$_.Name}}, Count,
        @{N="Users";E={ ($_.Group | Select-Object -ExpandProperty Username -Unique) -join ", " }}

$sfaIps | Format-Table -AutoSize

Example output:

IP              Count Users
--              ----- -----
192.168.50.154      12 DOMAIN\admin, DOMAIN\svcadmin
192.168.50.201       5 DOMAIN\admin
10.0.1.50            3 DOMAIN\dbadmin

These are the machines where SurePassID MFA is not installed or not enforcing. They are your highest-priority remediation targets.

All SFA Events by IP (Including SurePassID SFA)

$report = Get-Content "Output\PrivilegedAuthReport.json" | ConvertFrom-Json
$report.Events |
    Where-Object { $_.AuthFactors -eq "Sfa" } |
    Group-Object IpAddress |
    Sort-Object Count -Descending |
    Select-Object @{N="IP";E={$_.Name}}, Count,
        @{N="Users";E={ ($_.Group | Select-Object -ExpandProperty Username -Unique) -join ", " }},
        @{N="Sources";E={ ($_.Group | Select-Object -ExpandProperty SourceSystem -Unique) -join ", " }} |
    Format-Table -AutoSize

Note: A future version may include a dedicated SFA IP Summary section directly in the report. For now, the data is available in the event-level detail and can be extracted as shown above.

7. Remediation Playbook

Priority 1: CRITICAL (Address Immediately)

Priority 2: HIGH (Address Within 48 Hours)

Priority 3: MEDIUM (Address Within 1 Week)

Ongoing

8. Compliance Framework Mapping

HIPAA (45 CFR § 164.312)

CMMC 2.0 (NIST SP 800-171)

Key Audit Evidence

When presenting to auditors:

1. Privileged Auth Report — proves every privileged logon is logged and tracked
2. MFA Coverage Analysis — proves MFA is enforced on every machine (gaps = machines without MFA)
3. Privilege Drift Report — proves proactive monitoring of MFA posture
4. SFA/MFA Summary — proves MFA adoption rate with trend data
5. SFA-Only IP list — identifies exactly which machines need MFA remediation

Appendix: Report File Locations

Reports are written to the output directory (default: ./Output):