Which authentication methods are enabled, and for whom

#Requires -Modules Microsoft.Graph.Authentication
# Authentication methods policy: each method's state and included targets. Read-only (GET request only).

Connect-MgGraph -Scopes 'Policy.Read.AuthenticationMethod' -NoWelcome

$policy = Invoke-MgGraphRequest -Method GET -Uri '/v1.0/policies/authenticationMethodsPolicy'

foreach ($method in $policy['authenticationMethodConfigurations']) {
    $targets = @($method['includeTargets'] | Where-Object { $_ } | ForEach-Object { $_['id'] }) -join ', '
    [pscustomobject]@{
        Method         = $method['id']
        State          = $method['state']
        IncludeTargets = $targets
    }
}

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Reading the output

• Reads the policy with a GET request and lists each authenticationMethodConfigurations entry: its id (the method), its state (enabled or disabled) and the targets it includes. all_users means every user; anything else is a group ID.
• Weak methods (SMS, voice) enabled for all users are worth a second look once stronger methods are rolled out.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.