It’s now more important than ever to make sure your users have registered a strong authentication method. Especially when phishing emails are an increasing threat to your users and tenant. Strong authentication methods, such as the Microsoft Authenticator app or FIDO2 security keys (i.e. YubiKey), provide a more secure method of authentication over SMS or email OTP.
Finding out which users are using these stronger authentication methods is now made easy by using Graph API.
- PowerShell (MgGraph commands)
- PowerShell (MgGraph script)
Microsoft.Graph module
Connecting with the necessary permissions is the first step.
# Import the MgGraph module
Import-Module Microsoft.Graph.Identity.SignIns
# Connect to MgGraph with required permissions
Connect-MgGraph -Scopes "User.Read.All,UserAuthenticationMethod.Read.All,Directory.Read.All"Getting authentication methods
The Get-MgUserAuthenticationMethod command will get all registered MFA authentication methods for a user.
# Get a user's authentication method by using a user's UPN or Id
$methods = Get-MgUserAuthenticationMethod -UserId user@m365admins.com
# Display all authentication methods
$methods | Select -ExpandProperty AdditionalPropertiesAn output example is shown below. This shows two separate authentication methods for this user. One for a password and another for Microsoft Authenticator.
There are 9 different authentication methods that can be displayed with this command. There are also MgGraph commands specifically for each method.
| Authentication Method | MgGraph Command |
|---|---|
| Microsoft Authenticator | Get-MgUserAuthenticationMicrosoftAuthenticatorMethod |
| Phone | Get-MgUserAuthenticationPhoneMethod |
| Fido2 | Get-MgUserAuthenticationFido2Method |
| Password | Get-MgUserAuthenticationPasswordMethod |
| Windows Hello for Business | Get-MgUserAuthenticationWindowsHelloForBusinessMethod |
| Get-MgUserAuthenticationEmailMethod | |
| Temporary Access Pass | Get-MgUserAuthenticationTemporaryAccessPassMethod |
| Passwordless | N/A |
| Software Oath | Get-MgUserAuthenticationSoftwareOathMethod |
If you need a quicker way to retrieve a list of registered MFA methods for users, we’ve provided a script you can download.
Syntax
.\Get-UserMFAMethods.ps1 -UserPrincipalName <String or Object[]> [-ExcludeStrongAuthUsers <Switch>] [-Path <String>]Examples
Get list for individual user
.\Get-UserMFAMethods.ps1 -UserPrincipalName "user1@m365admins.com"Get list for multiple users
.\Get-UserMFAMethods.ps1 -UserPrincipalName "user1@m365admins.com,user2@m365admins.com"Get list of users not using strong authentication methods
.\Get-UserMFAMethods.ps1 -UserPrincipalName "user1@m365admins.com" -ExcludeStrongAuthUsersGet list and export output to CSV file
.\Get-UserMFAMethods.ps1 -UserPrincipalName "user1@m365admins.com" -Path C:\Downloads\UserMFA.csvPipe MgUser data to script and export output to CSV file
$financeUsers = Get-MgUser -Filter "Department eq 'Finance'"
$financeUsers | .\Get-UserMFAMethods.ps1 -Path C:\Downloads\FinanceMFA.csvPipe object array to script and display list
# Import CSV list of users.
# Must contain column with name "UserPrincipalName".
$importedUsers = Import-Csv -Path C:\Files\CompanyUsers.csv
$importedUsers | .\Get-UserMFAMethods.ps1