Comments on: How to Report the MFA Status for Entra ID User Accounts https://practical365.com/mfa-status-user-accounts/ Practical Office 365 News, Tips, and Tutorials Thu, 11 Jul 2024 19:08:38 +0000 hourly 1 https://wordpress.org/?v=6.6.1 By: <div class="apbct-real-user-wrapper"> <div class="apbct-real-user-author-name">Tony Redmond</div> <div class="apbct-real-user-badge" onmouseover=" let popup = document.getElementById('apbct_trp_comment_id_291867'); popup.style.display = 'inline-flex'; "> <div class="apbct-real-user-popup" id="apbct_trp_comment_id_291867"> <div class="apbct-real-user-title"> <p class="apbct-real-user-popup-header">The Real Person!</p> <p class="apbct-real-user-popup-text">Author <b>Tony Redmond</b> acts as a real person and passed all tests against spambots. Anti-Spam by CleanTalk.</p> </div> </div> </div> </div> https://practical365.com/mfa-status-user-accounts/#comment-291867 Mon, 08 Apr 2024 12:55:51 +0000 https://practical365.com/?p=60292#comment-291867 In reply to David.

The date comes from the information gathered from Entra ID logs. It is not returned by the cmdlet.

]]>
By: David https://practical365.com/mfa-status-user-accounts/#comment-291853 Mon, 08 Apr 2024 10:55:50 +0000 https://practical365.com/?p=60292#comment-291853 hi Tony
many thanks for taking the time to create all the reports you do.

in this report(from github) you have this section to get the date MFA is last used for a user.

$MFAVerifiedDate = $MFAUserData | Where-Object {$_.’User Id’ -eq $User.Id} | Select-Object -ExpandProperty ‘Date (UTC)’
If ($MFAVerifiedDate) {
$MFAVerifiedDate = (Get-Date $MFAVerifiedDate -format ‘dd-MMM-yyyy HH:mm’)
}

‘MFA last used’ = $MFAVerifiedDate

I dont see this property as being available in 2.16 of Get-MgBetaReportAuthenticationMethodUserRegistrationDetail

do you have this available to you?

]]>
By: <div class="apbct-real-user-wrapper"> <div class="apbct-real-user-author-name">Tony Redmond</div> <div class="apbct-real-user-badge" onmouseover=" let popup = document.getElementById('apbct_trp_comment_id_289696'); popup.style.display = 'inline-flex'; "> <div class="apbct-real-user-popup" id="apbct_trp_comment_id_289696"> <div class="apbct-real-user-title"> <p class="apbct-real-user-popup-header">The Real Person!</p> <p class="apbct-real-user-popup-text">Author <b>Tony Redmond</b> acts as a real person and passed all tests against spambots. Anti-Spam by CleanTalk.</p> </div> </div> </div> </div> https://practical365.com/mfa-status-user-accounts/#comment-289696 Thu, 07 Mar 2024 23:14:43 +0000 https://practical365.com/?p=60292#comment-289696 In reply to Andrew.

I believe that some information can be extracted from the sign-in logs to help identify what devices are in use. Unhappily, Entra ID doesn’t capture device information for every sign-in record.

]]>
By: Andrew https://practical365.com/mfa-status-user-accounts/#comment-289670 Thu, 07 Mar 2024 16:07:17 +0000 https://practical365.com/?p=60292#comment-289670 Great article. Any chance of a script or way to view what devices people are using to MFA? Ran into a scenario where a person had two phones registered and was only using one of them. I’m wanting to automatically go through our environment and see which devices have not been used in >30 days. Thanks!

]]>
By: <div class="apbct-real-user-wrapper"> <div class="apbct-real-user-author-name">Tony Redmond</div> <div class="apbct-real-user-badge" onmouseover=" let popup = document.getElementById('apbct_trp_comment_id_287597'); popup.style.display = 'inline-flex'; "> <div class="apbct-real-user-popup" id="apbct_trp_comment_id_287597"> <div class="apbct-real-user-title"> <p class="apbct-real-user-popup-header">The Real Person!</p> <p class="apbct-real-user-popup-text">Author <b>Tony Redmond</b> acts as a real person and passed all tests against spambots. Anti-Spam by CleanTalk.</p> </div> </div> </div> </div> https://practical365.com/mfa-status-user-accounts/#comment-287597 Thu, 15 Feb 2024 14:06:31 +0000 https://practical365.com/?p=60292#comment-287597 In reply to Eve.

The information you see in the Entra admin center tells you if someone has registred authentication methods that might be used with MFA. It does not tell you if they are using MFA.

As noted in the article, “The Get-MgBetaReportAuthenticationMethodUserRegistrationDetail cmdlet makes the same information available.”

It is by combining sign-in, registration, and user data that we can create a picture of whether accounts use MFA. That’s what the script does.

]]>
By: Eve https://practical365.com/mfa-status-user-accounts/#comment-287594 Thu, 15 Feb 2024 13:54:58 +0000 https://practical365.com/?p=60292#comment-287594 I see a lot of what we need via GUI; Identity – Protection – Authentication Methos – User registration Details

Multifactor Capable, Passwordless Capable, SSPR Capable, Default, Registered, Last Updates Time

]]>
By: <div class="apbct-real-user-wrapper"> <div class="apbct-real-user-author-name">Tony Redmond</div> <div class="apbct-real-user-badge" onmouseover=" let popup = document.getElementById('apbct_trp_comment_id_286834'); popup.style.display = 'inline-flex'; "> <div class="apbct-real-user-popup" id="apbct_trp_comment_id_286834"> <div class="apbct-real-user-title"> <p class="apbct-real-user-popup-header">The Real Person!</p> <p class="apbct-real-user-popup-text">Author <b>Tony Redmond</b> acts as a real person and passed all tests against spambots. Anti-Spam by CleanTalk.</p> </div> </div> </div> </div> https://practical365.com/mfa-status-user-accounts/#comment-286834 Fri, 02 Feb 2024 17:30:16 +0000 https://practical365.com/?p=60292#comment-286834 In reply to Julio.

I think you mean “per-user MFA.”

The page gives access to per-user MFA enablement. However, it’s an old page that is due to go away when Microsoft deprecates per-user MFA (aka, legacy MFA) in favor of conditional access policies (to enforce MFA on a per-connection basis). I wouldn’t recommend anyone using per-user MFA now because you’ll only end up having to migrate.

]]>
By: Julio https://practical365.com/mfa-status-user-accounts/#comment-286833 Fri, 02 Feb 2024 17:25:59 +0000 https://practical365.com/?p=60292#comment-286833 Hello Tony!

Thanks for sharing this information. As you say, I can’t use Get-MsolUser. I used a workaround using a GUI, entering Entra ID -> Users -> All Users and selecting Peer User MFA. The link opens the Multifactor authentication page.
This may help others.
Attention: This site does not permit export but allows seeing all MFA user statuses and changing them easily.

Best regards!

]]>
By: Steve https://practical365.com/mfa-status-user-accounts/#comment-286824 Fri, 02 Feb 2024 15:15:06 +0000 https://practical365.com/?p=60292#comment-286824 In reply to Tony Redmond.

Thanks for the update! Seems to be working now. Thanks, again!

]]>
By: Tony Redmond https://practical365.com/mfa-status-user-accounts/#comment-286811 Fri, 02 Feb 2024 11:01:17 +0000 https://practical365.com/?p=60292#comment-286811 In reply to Steve.

Use this script to install the latest versions of Office 365 PowerShell modules including the SDK (and clean up old modules): https://office365itpros.com/2020/06/22/update-powershell-modules-m365/

I found a bug. Download the latest version of the script from GitHub and give it a whirl.

]]>