How to get MFA method for user by poweshell or Graph API

Raymond 120

I want to identify which MFA method was actually used by a user during sign‑in.

Please help

VEMULA SRISAI 9,820 Reputation points Microsoft External Staff Moderator

2026-02-25T19:18:23.27+00:00
Hello Raymond,

To identify which MFA method was actually used during a sign‑in, you need to check Microsoft Entra ID sign‑in logs. Registered MFA methods alone won’t tell you what was used in a specific login.

Recommended approach (Actual MFA used)

Use Microsoft Graph sign‑in logs (Beta): PowerShell

PowerShell

Connect-MgGraph -Scopes AuditLog.Read.All,SignIns.Read.All

Get-MgBetaAuditSignIn -Filter "userPrincipalName eq '******@domain.com'" |

Select createdDateTime, authenticationMethodsUsed, conditionalAccessStatus

Show more lines

The authenticationMethodsUsed property shows the exact MFA method used (e.g., Microsoft Authenticator push, SMS, FIDO2, Temporary Access Pass).

This data is available only via the /beta endpoint.

Requires Entra ID P1/P2 and Reports Reader / AuditLog.Read.All permissions. What does not show actual usage

Registered MFA methods:

PowerShell

Get-MgUserAuthenticationMethod -UserId ******@domain.com

Show more lines

This only lists what the user has enrolled, not what was used during sign‑in.

signInPreferences: Shows the user’s preferred/default MFA method, not per‑sign‑in usage.

https://learn.microsoft.com/en-us/graph/authenticationmethods-get-started?tabs=http

Your answer