MFA Rollout Tracker

What this skill does

Pulls MFA enrollment data from an identity provider (GitHub Org, Google Workspace, Okta, Entra ID) and produces a tracker that segments users without MFA by team and tenure, plus a nudge plan with deadlines.

Inputs

• provider: one of github-org, google-workspace, okta, entra-id.
• org: provider-specific organization id.
• Provider credentials in env (PAT, service account JSON, API token).
• Optional team_mapping: CSV mapping email -> team for richer segmentation.

Steps

1. List users + their MFA status:
   • GitHub: gh api orgs/<org>/members --paginate joined with the security manager's 2fa_disabled filter (only available to org admins).
   • Google Workspace: gcloud directory users list --domain <domain> --query 'isEnrolledIn2Sv=false'.
   • Okta: okta-admin users list --filter 'profile.mfaEnrolled eq false' (or via REST GET /api/v1/users?search=...).
   • Entra ID: Get-MgUser -All then Get-MgUserAuthenticationMethod (PowerShell) or Graph API.
2. For each user, capture: handle/email, name, hire/created date, last login.
3. Join with team_mapping to add team labels; users without a team map to unknown.
4. Compute tenure buckets: 0-30d, 30-90d, 90-365d, >1y.
5. Compute risk: long-tenure-and-no-MFA is highest-priority; admins-no-MFA is critical.
6. Generate a nudge plan: bucket users into reminder waves (e.g., wave 1 = admins, wave 2 = >1y tenure, wave 3 = the rest). Assign a deadline 14 days post-wave start.
7. Compose templated email/Slack messages per wave (do not auto-send; this skill produces drafts).
8. Emit a markdown tracker plus CSV.

Output

mfa-tracker.md with: enrollment summary (count enrolled, count not, percent), per-team table, per-tenure-bucket table, nudge plan with dates. Plus mfa-not-enrolled.csv with one row per user. Exit 1 if any admin lacks MFA.

Verification

Cross-check the not-enrolled count by spot-querying three users in the provider's admin UI. After waves go out, re-run the tracker weekly; the not-enrolled count must monotonically decrease (small fluctuations from new hires are acceptable but should be flagged separately). Confirm team_mapping coverage; if more than 20% of users land in unknown, the mapping is stale.

Edge cases

• Users who set up TOTP but later removed it: provider APIs expose this differently; treat current enrollment status as the source of truth.
• Service accounts: exclude from the count and document the exclusion list.
• Users with MFA-via-SSO upstream: the local provider may report no MFA but SSO IdP enforces it; surface as inherited-mfa rather than not-enrolled.
• Newly created accounts within the last 7 days: defer to wave 3; a fresh hire shouldn't be in the first reminder.