KBY Technologies Logo
Microsoft Entra ID · PowerShell 7.6

Admins with no MFA method registered

Which users who hold an admin role have not registered a strong authentication method for multifactor authentication?

Script

#Requires -Modules Microsoft.Graph.Authentication, Microsoft.Graph.Reports
# Users with an admin role and no strong MFA method registered. Read-only.

Connect-MgGraph -Scopes 'AuditLog.Read.All' -NoWelcome

Get-MgReportAuthenticationMethodUserRegistrationDetail -All -Filter 'isMfaRegistered eq false' |
    Where-Object { $_.IsAdmin } |
    Sort-Object UserPrincipalName |
    Select-Object UserPrincipalName, UserDisplayName, UserType, IsAdmin, IsMfaRegistered, IsMfaCapable,
        @{ Name = 'MethodsRegistered'; Expression = { $_.MethodsRegistered -join ', ' } },
        LastUpdatedDateTime

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Reading the output

  • Uses the authentication methods registration report: isAdmin means the user has an admin role in the tenant, and isMfaRegistered false means no strong method is registered. The report is filtered on isMfaRegistered by the service and on isAdmin in PowerShell, because Microsoft lists $filter support for isMfaRegistered but not for isAdmin.
  • These are the accounts to fix first: an admin who can sign in with a password alone is the easiest way into the tenant.
  • The registration details API doesn't work for disabled users, so disabled accounts aren't listed.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.

Connect-MgGraph (Microsoft.Graph.Authentication)Get-MgReportAuthenticationMethodUserRegistrationDetail (Microsoft.Graph.Reports)List userRegistrationDetails: permissions, roles and $filter supportuserRegistrationDetails resource type: isAdmin, isMfaRegisteredWhere-Object (Microsoft.PowerShell.Core)Sort-Object (Microsoft.PowerShell.Utility)Select-Object (Microsoft.PowerShell.Utility)
All scripts