PowerShell Script Identifies Users Lacking MFA in Microsoft Entra ID

Organizations implementing Multi-Factor Authentication (MFA) often face the challenge of ensuring complete user adoption. While web interfaces can list registered users, a more efficient method is needed to track down those who may have been missed during a rollout. This article introduces a PowerShell script designed to automate this process, leveraging the latest capabilities within the Microsoft ecosystem.

The script employs beta commands from the Microsoft.Graph.Beta library, specifically targeting authentication method details. By connecting to Microsoft Graph with the necessary auditing scopes (AuditLog.Read.All, User.Read.All), administrators can query a comprehensive dataset of user authentication configurations. The core of the script involves retrieving user registration details and filtering for those where MFA is not yet enabled.

Specifically, the script utilizes the Get-MgBetaReportAuthenticationMethodUserRegistrationDetail cmdlet to fetch all relevant authentication data. It then filters this output using a Where-Object clause to isolate users where the IsMfaRegistered property is set to $false. This direct approach efficiently identifies the target group without manual intervention.

Further processing of the identified non-MFA users involves retrieving additional account details, such as whether the account is enabled, using Get-MgUser. The script then constructs custom objects containing key information like User Principal Name, Display Name, Account Enabled status, and the methods registered for sign-in. This structured output facilitates easier review and management.

While the MethodsRegistered column will typically be blank for users identified as non-MFA, the script offers flexibility. It can be adapted to identify users employing less secure MFA methods, such as SMS-based authentication, by modifying the filtering criteria. This allows for a more granular approach to strengthening an organization's security posture.

The output can be presented in a user-friendly format, such as an Out-GridView window, allowing administrators to quickly review the list of users who still require MFA enrollment. The script focuses on enabled accounts, as these are the active users who pose the most immediate risk if MFA is not enforced.

This tool is particularly valuable for organizations undergoing phased MFA rollouts or those needing to conduct regular audits to maintain compliance and security standards. By automating the identification of non-MFA users, security teams can proactively address gaps and ensure a more robust defense against account compromise attempts.

The script's reliance on beta Graph commands highlights the evolving nature of Microsoft's identity and access management tools. Staying updated with these new cmdlets can provide administrators with more powerful and efficient ways to manage their cloud environments and enhance security.