Users with MFA: Enabled, Disabled, Enforced

Question

I manage a Azure AD
Does anyone have a PowerShell script that can help me get all users from Azure Active directory with MFA: Enabled, Disabled, Enforced

Thanks for the help.

Answer 1

@GuestGuivenchi

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others", I'll repost your solution in case you'd like to accept the answer.

Issue:

You're looking for a PowerShell scrip that can get all users from Azure AD along with their MFA status - Enabled, Disabled, or Enforced.

Solution:

To resolve your issue, you were able to follow this 3rd party article detailing how to Export Office 365 users MFA status with PowerShell.

• For more info - Export Office 365 users MFA status with PowerShell

Get-MFAReport PowerShell script:

Write-Host "Finding Azure Active Directory Accounts..."
$Users = Get-MsolUser -All | Where-Object { $_.UserType -ne "Guest" }
$Report = [System.Collections.Generic.List[Object]]::new() # Create output file
Write-Host "Processing" $Users.Count "accounts..." 
ForEach ($User in $Users) {

    $MFADefaultMethod = ($User.StrongAuthenticationMethods | Where-Object { $_.IsDefault -eq "True" }).MethodType
    $MFAPhoneNumber = $User.StrongAuthenticationUserDetails.PhoneNumber
    $PrimarySMTP = $User.ProxyAddresses | Where-Object { $_ -clike "SMTP*" } | ForEach-Object { $_ -replace "SMTP:", "" }
    $Aliases = $User.ProxyAddresses | Where-Object { $_ -clike "smtp*" } | ForEach-Object { $_ -replace "smtp:", "" }

    If ($User.StrongAuthenticationRequirements) {
        $MFAState = $User.StrongAuthenticationRequirements.State
    }
    Else {
        $MFAState = 'Disabled'
    }

    If ($MFADefaultMethod) {
        Switch ($MFADefaultMethod) {
            "OneWaySMS" { $MFADefaultMethod = "Text code authentication phone" }
            "TwoWayVoiceMobile" { $MFADefaultMethod = "Call authentication phone" }
            "TwoWayVoiceOffice" { $MFADefaultMethod = "Call office phone" }
            "PhoneAppOTP" { $MFADefaultMethod = "Authenticator app or hardware token" }
            "PhoneAppNotification" { $MFADefaultMethod = "Microsoft authenticator app" }
        }
    }
    Else {
        $MFADefaultMethod = "Not enabled"
    }
  
    $ReportLine = [PSCustomObject] @{
        UserPrincipalName = $User.UserPrincipalName
        DisplayName       = $User.DisplayName
        MFAState          = $MFAState
        MFADefaultMethod  = $MFADefaultMethod
        MFAPhoneNumber    = $MFAPhoneNumber
        PrimarySMTP       = ($PrimarySMTP -join ',')
        Aliases           = ($Aliases -join ',')
    }
                 
    $Report.Add($ReportLine)
}

Write-Host "Report is in c:\temp\MFAUsers.csv"
$Report | Select-Object UserPrincipalName, DisplayName, MFAState, MFADefaultMethod, MFAPhoneNumber, PrimarySMTP, Aliases | Sort-Object UserPrincipalName | Out-GridView
$Report | Sort-Object UserPrincipalName | Export-CSV -Encoding UTF8 -NoTypeInformation "c:\temp\MFAUsers.csv"

• If I missed anything please let me know and I'd be happy to add it to my answer, or feel free to comment below with any additional information.

---

I hope this helps!

If you have any other questions, please let me know. Thank you again for your time and patience throughout this issue.

Answer 2

Something basic but should work: The script checks users based on their MFA settings: Enabled, Disabled, or Enforced.

Install-Module -Name AzureAD -Force -AllowClobber
Connect-AzureAD

# Fetch all users
$users = Get-AzureADUser -All $true
# Initialize empty arrays for each MFA category
$MFAEnabled = @()
$MFADisabled = @()
$MFAEnforced = @()
foreach ($user in $users) {
    # Fetch the MFA state
    $mfaState = (Get-MsolUser -UserPrincipalName $user.UserPrincipalName).StrongAuthenticationRequirements.State
    $strongAuthMethods = (Get-MsolUser -UserPrincipalName $user.UserPrincipalName).StrongAuthenticationMethods
    # Check for enforced MFA
    $mfaEnforced = $strongAuthMethods | Where-Object { $_.MethodType -eq "PhoneAppOTP" }
    if ($mfaState -eq $null -or $mfaState -eq "Disabled") {
        $MFADisabled += $user
    } elseif ($mfaEnforced) {
        $MFAEnforced += $user
    } else {
        $MFAEnabled += $user
    }
}
# Output results
Write-Host "MFA Enabled Users:" -ForegroundColor Green
$MFAEnabled | ForEach-Object { Write-Host $_.UserPrincipalName }
Write-Host "`nMFA Disabled Users:" -ForegroundColor Yellow
$MFADisabled | ForEach-Object { Write-Host $_.UserPrincipalName }
Write-Host "`nMFA Enforced Users:" -ForegroundColor Red
$MFAEnforced | ForEach-Object { Write-Host $_.UserPrincipalName }

Answer 3

Why reinvent the wheel?

https://lazyadmin.nl/powershell/list-office365-mfa-status-powershell/

Answer 4

I share this post that helped me with the problem
https://www.alitajran.com/export-office-365-users-mfa-status-with-powershell/#:~:text=Check%20MFA%20status%20in%20Microsoft%20365%20admin%20center,-Let%27s%20look%20at&text=Sign%20in%20to%20Microsoft%20365,their%20multi%2Dfactor%20auth%20status