Get MFA Status Report for Microsoft 365 Users

In this guide, I’ll show you how to create a MFA status report for Microsoft 365 Users with PowerShell, Entra Admin Center and 365 Pro Toolkit.

Get MFA Status with Entra Admin Center

In the Entra admin Center you can view a list of every user and if they have MFA methods registered. This can help you determine if the users have completed the MFA registration process.

1. Sign into Entra Admin Center
2. In the left menu click on Authentication methods
3. Click user registration details
4. Use the filter Multifactor authentication capable to list all or only users that are capable

Get MFA Status Report with PowerShell

The examples in this section use the Microsoft Graph module to check the MFA status for Microsoft 365 users. You will need to have the Graph module installed.

Important

The PowerShell commands report the authentication method registered for each user, this is how the MFA status is determined. Unfortunately, Microsoft does not provide a command that simply says if an account has MFA enabled or not, it has to be calculated.

When passwordAuthenticationMethod is the only authentication method listed this means the user does not have MFA enabled. The script I provide below will check the authentication methods and create an MFA Status field (Enabled or Disabled).

Example 1. Get MFA Status for single User

To check the MFA status of a single user is very easy, you don’t need a bloated script for this.

Step 1. Connect to Microsoft Graph

Before you can get Office 365 Users and check the MFA status you first need to connect to Microsoft Graph.

The below command will permit you to read the full set of Azure user profile properties.

Connect-MgGraph -Scopes "User.Read.All"

Note: Some users have mentioned that the script fails with request authorization failed. In this case, try using Connect-MgGraph -Scopes “UserAuthenticationMethod.Read.All”

You will be prompted to sign in with your account.

When you have authenticated PowerShell should display “Welcome to Microsoft Graph!”

Step 2. Run the Get-MGUserAuthenticationMethod cmdlet

Run the below command to get the MFA status for a single user.

Get-MGUserAuthenticationMethod -userid abbie.peters@activedirectorypro.com | fl

In this example, I’m checking the MFA status for the user abbie.peters@activedirectorypro.com.

The authentication method of microsoft.graph.passwordAuthenticationMethod is the only method listed, this means MFA is not enabled for this user.

Now I’ll check the authentication methods for my account.

In the screenshot above, you can see my account returns multiple authentication methods, this means my account has MFA enabled.

It gets much more complicated when checking all users, the good news is I’ve created a script you can use.

Example 2. Get MFA Status for all Microsoft 365 Users

The script below was tested on a tenant with over 11,000 users and it completed in 1 minute 30 seconds.

Step 1. Copy the script below

<#
=============================================================================================
Name:           Get MFA Status Report (bulk report API)
Description:    Gets MFA registration status for all users from the tenant-wide authentication methods registration report
Version:        2.0
Website:        activedirectorypro.com
Requires:       Microsoft.Graph.Reports module, AuditLog.Read.All (+ Directory.Read.All)

Usage:
~~~~~~
Connect-MgGraph -Scopes 'AuditLog.Read.All','Directory.Read.All'
.\Get-MfaStatus-Fast.ps1
.\Get-MfaStatus-Fast.ps1 -SummaryOnly
.\Get-MfaStatus-Fast.ps1 | Export-Csv .\mfa-status.csv -NoTypeInformation

Notes:
~~~~~~
- Reads every user in a few paged calls instead of one call per user, which is the whole reason this runs in seconds rather than tens of minutes.
- MFAstatus comes from the tenant's own isMfaRegistered flag rather than being inferred from which methods came back.
- There is no password column. Every account has a password, so the report does not list it as a registered method and it told you nothing about MFA anyway.
- If this returns 403, the registration report is likely gated behind Entra ID P1/P2 in your tenant. Use the parallel fallback at the bottom of this file instead.

Parameters:
~~~~~~~~~~~
-SummaryOnly   Print the counts only, with no per-user table.
=============================================================================================
#>

param(
    [switch]$SummaryOnly
)

# One call per ~1000 users, not one call per user.
Write-Host 'Retrieving authentication method registration details...' -ForegroundColor Cyan
$details = Get-MgReportAuthenticationMethodUserRegistrationDetail -All

Write-Host "Retrieved $($details.Count) users." -ForegroundColor Cyan

$results = foreach ($detail in $details) {

    # Case-insensitive membership test; -contains is case-insensitive by default.
    $methods = $detail.MethodsRegistered

    # Computed up front: Windows PowerShell 5.1 cannot take an if statement as a hashtable value.
    $status = if ($detail.IsMfaRegistered) { 'Enabled' } else { 'Disabled' }

    [PSCustomObject]@{
        user          = $detail.UserPrincipalName
        displayName   = $detail.UserDisplayName
        MFAstatus     = $status
        defaultMethod = $detail.DefaultMfaMethod
        email         = $methods -contains 'email'
        fido2         = [bool]($methods | Where-Object { $_ -like 'fido2*' -or $_ -like 'passKey*' })
        app           = [bool]($methods | Where-Object { $_ -like 'microsoftAuthenticator*' })
        phone         = [bool]($methods | Where-Object { $_ -like '*Phone' })
        softwareoath  = $methods -contains 'softwareOneTimePasscode'
        tempaccess    = $methods -contains 'temporaryAccessPass'
        hellobusiness = $methods -contains 'windowsHelloForBusiness'
        isAdmin       = $detail.IsAdmin
        userType      = $detail.UserType
    }
}

$total       = @($results).Count
$enabled     = @($results | Where-Object { $_.MFAstatus -eq 'Enabled' }).Count
$notEnabled  = $total - $enabled
$adminsNoMfa = @($results | Where-Object { $_.isAdmin -and $_.MFAstatus -ne 'Enabled' }).Count
$percent     = if ($total) { [math]::Round( ($enabled / $total) * 100, 1 ) } else { 0 }

# Table first, summary last, so the summary is still on screen after a few thousand rows have scrolled past. Objects go to the pipeline as normal, so piping the script to Export-Csv still works.
if (-not $SummaryOnly) {
    $results | Sort-Object MFAstatus, user
}

Write-Host ''
Write-Host 'MFA Registration Summary' -ForegroundColor Cyan
Write-Host '------------------------' -ForegroundColor Cyan
Write-Host ('  Total users:   {0,7:N0}' -f $total)
Write-Host ('  MFA enabled:   {0,7:N0}  ({1}%)' -f $enabled, $percent) -ForegroundColor Green
Write-Host ('  Not enabled:   {0,7:N0}' -f $notEnabled) -ForegroundColor Yellow

# Privileged accounts without MFA are the ones worth acting on first.
if ($adminsNoMfa -gt 0) {
    Write-Host ('  Admins w/o MFA:{0,7:N0}' -f $adminsNoMfa) -ForegroundColor Red
}
Write-Host ''

Step 2. Save the script to a file. I named mine Get-MfaStatus-Fast.ps1

Step 3. To run the script open PowerShell and first connect to MS Graph.

Connect-MgGraph -Scopes "User.Read.All"

Step 3. Then enter the path and name of the script to execute it. The script will display how many accounts it found and output the account it is processing.

When the script is completed it will display the MFA status and authentication methods for each user.

To export the MFA status report to CSV use the export-CSV parameter.

.\Get-MfaStatus-Fast.ps1 | Export-Csv .\mfa-status.csv -NoTypeInformation

To get a summary report only use the -SummaryOnly paramater

.\Get-MfaStatus-Fast.ps1 -SummaryOnly

MFA Status Report with the 365 Pro Toolkit

The 365 Pro Toolkit makes it easy to get the MFA status for all users. Check the MFA status and the authentication method for all users in your tenant. The report can be exported to CSV, Excel or PDF.

1. Click on Reports > Security
2. Under MFA click on MFA Status

The 365 Pro Toolkit includes the following MFA reports.

• MFA Status: every user’s MFA posture (registered, capable, methods, admin/enabled/licensed).
• MFA Policy Source: where each user’s MFA comes from (per-user legacy state vs Conditional Access / Security Defaults).
• MFA Enabled Users: users who have registered for MFA, with their methods.
• MFA Not Enabled: users who haven’t registered for MFA.
• MFA Capable but Not Registered: licensed/capable users who still haven’t set it up (the “should be done” gap).
• Admins Without MFA: admin accounts missing MFA (highest-risk exposure).
• Enabled Users Without MFA: active, licensed users with no MFA.
• Passwordless Users: users capable of passwordless sign-in and their preferred method.
• SSPR Not Registered: users not registered for Self-Service Password Reset.

Also included is a security dashboard to get a quick overview of your MFA coverage and risky accounts.