KBY Technologies Logo
Microsoft Entra ID · PowerShell 7.6

Users with no MFA method registered

Which users have not registered a strong authentication method for multifactor authentication, according to the authentication methods registration report?

Script

#Requires -Modules Microsoft.Graph.Authentication, Microsoft.Graph.Reports
# Users who have not registered a strong authentication method for MFA. Read-only.

Connect-MgGraph -Scopes 'AuditLog.Read.All' -NoWelcome

Get-MgReportAuthenticationMethodUserRegistrationDetail -All -Filter 'isMfaRegistered eq false' |
    Sort-Object UserPrincipalName |
    Select-Object UserPrincipalName, UserDisplayName, UserType, IsAdmin, IsMfaCapable, IsMfaRegistered,
        @{ Name = 'MethodsRegistered'; Expression = { $_.MethodsRegistered -join ', ' } },
        LastUpdatedDateTime

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Reading the output

  • Filters the report on isMfaRegistered eq false. isMfaRegistered means a strong method is registered; it does not check whether the authentication methods policy allows that method (that is isMfaCapable, which the output also shows).
  • The registration details API does not work for disabled users, so disabled accounts are not listed.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.

Connect-MgGraph (Microsoft.Graph.Authentication)Get-MgReportAuthenticationMethodUserRegistrationDetail (Microsoft.Graph.Reports)List userRegistrationDetails: permissions, roles and $filter supportuserRegistrationDetails resource typeSort-Object (Microsoft.PowerShell.Utility)Select-Object (Microsoft.PowerShell.Utility)
All scripts