What to do with the users listed under Per-user multifactor authentication?

@Marcin Policht ,
Thank you for the clarification, so I assume I must run this to clear out the users that are still enforced with the below command:

Get-MgUser -All |
    Where-Object { $_.StrongAuthenticationRequirements } |
    ForEach-Object {
        Update-MgUser -UserId $_.Id -StrongAuthenticationRequirement @()
    }

What will be the impact on the users after the above command is executed?

Correct - running that command removes only the legacy per-user MFA enforcement flag. It does not remove the user’s registered MFA methods, it does not delete anything, and it does not stop MFA if your Conditional Access or authentication method policies require it. The only change is that users will no longer be forced to do MFA by the old per-user mechanism, so any MFA challenge they see afterward will come solely from Conditional Access. For users already governed by CA, they will notice no change at all. For users who were enforced only by per-user MFA and not covered by any CA policy, MFA prompts will stop until they fall under a modern policy. Other than that, there is no disruption or downtime.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

OK, so the cmdlet below doesn't return any result at all.

Get-MgUser -All |  Where-Object { $_.StrongAuthenticationRequirements }

However, when browsing the majority of the users under the Per-user multifactor authentication [https://entra.microsoft.com/#view/Microsoft_AAD_AuthenticationMethods/MultifactorAuthenticationConfig.ReactView] I can see the Status is showing Enforced.

is this can be cleared manually or leave it as is ?

Looks like you might need to use the approach described in https://office365itpros.com/2024/06/14/per-user-mfa-state/ to get the accurate results

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

@Marcin Policht ,
Thank you, yes, the recent script you've suggested by Tony Redmond shows more detailed results.

So, there are more than half of my users are showing 'Per user MFA state Enforced.'

How to disable them all using the below ?

Update-MgUser -UserId $_.Id -StrongAuthenticationRequirement @()