MFA Status of Users

Question

We want to extract the report of the User's MFA registration status in the form of whether it is Enabled, Enforced, or Disabled.

Answer 1

Hi Argus Technology

I understand you want to extract a report of each user's Per-User MFA registration status (Enabled, Disabled, or Enforced).

You can use PowerShell or the Microsoft Graph API to achieve this. For a single user, you can use the following Graph API endpoint:

GET https://graph.microsoft.com/beta/users/{replace-user-id}/authentication/requirements

This endpoint retrieves the per-user MFA status for one user.

To get the per-user MFA status for all users, you can use the PowerShell script below:

Connect-Entra -Scopes 'User.Read.All', 'UserAuthenticationMethod.Read.All', 'Policy.Read.All'
$users = Get-EntraUser -All -Select Id, UserPrincipalName, DisplayName
Write-Output "Amount of requests within `"fetchAll`": $($users.Length)"
$usersReport = @()
$users | ForEach-Object {
    $userObj= New-Object -TypeName PSObject
    $userObj | Add-Member -Name 'Id' -MemberType NoteProperty -Value $_.id
    $userObj | Add-Member -Name 'DisplayName' -MemberType NoteProperty -Value $_.DisplayName
    $userObj | Add-Member -Name 'UserPrincipalName' -MemberType NoteProperty -Value $_.UserPrincipalName
    $userObj | Add-Member -Name 'PerUserMFAState' -MemberType NoteProperty -Value (Get-EntraBetaUserAuthenticationRequirement -UserId $_.id).PerUserMFAState
    $usersReport += $userObj
}
$usersReport | ft

Hope this helps. Do let us know if you any further queries.

Please remember to "Accept Answer" if answer helped you.This will help us as well as others in the community who might be researching similar questions.

Answer 2

You mean the good old per-user MFA status? You can use the following query:

GET https://graph.microsoft.com/v1.0/users?$select=id,userPrincipalName,displayName,perUserMfaState

See the official documentation for more info: https://learn.microsoft.com/en-us/graph/api/authentication-update?view=graph-rest-beta&tabs=http#example-2-update-a-users-mfa-state