In every MFA rollout, there will come a time where you think you are closing in on "done", and some automation to list what's left would be handy. Something quicker than scrolling through the web interface through thousands of accounts ...
This is that method.
Also, remember when we discussed yesterday about the beta graph commands in the Microsoft.Graph.Beta library? We'll use one of those beta commands here!
import, if it's not already there
Import-Module -Name Microsoft.Graph.Beta.Reports
with the necessary auditing scope
Connect-MgGraph -Scopes "AuditLog.Read.All", "User.Read.All"
$AllMFADetails = Get-MgBetaReportAuthenticationMethodUserRegistrationDetail -All
We're only interested in users who are NOT yet registered for MFA
$NonMFAUsers = $AllMFAdetails | Where-Object { $_.IsMfaRegistered -eq $false }
$t = foreach ($User in $NonMFAUsers) {
# user by user, collect account details (primary if it's enabled)
# then construct the userobj record
$UserObj = Get-MgUser -UserId $User.Id -Select Id, AccountEnabled
[PSCustomObject]@{
"UserPrincipalName" = $User.UserPrincipalName
"DisplayName" = $User.UserDisplayName
"AccountEnabled" = $UserObj.AccountEnabled
"MethodsRegistered" = ($User.UserPreferredMethodForSignIn -join ", ")
}
}
$t | Out-GridView -Title "NON-MFA Users"
Note that the "MethodsRegistered" column will likely be blank, as these are non-MFA users.
Also, you are likely only interested in enabled accounts
I'm not displaying the output in this case, as it's essentially a list of actual user accounts.
You can also modify this a bit, for instance if you were tightening up your MFA setup, because your auditor told you to root out folks using SMS for MFA for instance, this is definitely the command set to use. You'd want $_.IsMfaRegistered -eq $true, but then look for "SMS" in the Methods registered.
Give this a try, let us know in the comments if you find some unexpected folks who skated by the MFA login policy requirements ....
===============
Rob VandenBrink
[email protected]