In every MFA rollout, there will come a time where you think you are closing in on “done”, and some automation to list what’s left would be handy. Something quicker than scrolling through the web interface through thousands of accounts …
This is that method.
Also, remember when we discussed yesterday about the beta graph commands in the Microsoft.Graph.Beta library? We’ll use one of those beta commands here!
# import, if it’s not already there
Import-Module -Name Microsoft.Graph.Beta.Reports
# with the necessary auditing scope
Connect-MgGraph -Scopes “AuditLog.Read.All”, “User.Read.All”
$AllMFADetails = Get-MgBetaReportAuthenticationMethodUserRegistrationDetail -All
# We’re only interested in users who are NOT yet registered for MFA
$NonMFAUsers = $AllMFAdetails | Where-Object { $_.IsMfaRegistered -eq $false }
$t = foreach ($User in $NonMFAUsers) {
# user by user, collect account details (primary if it’s enabled)
# then construct the userobj record
$UserObj = Get-MgUser -UserId $User.Id -Select Id, AccountEnabled
[PSCustomObject]@{
“UserPrincipalName” = $User.UserPrincipalName
“DisplayName” = $User.UserDisplayName
“AccountEnabled” = $UserObj.AccountEnabled
“MethodsRegistered” = ($User.UserPreferredMethodForSignIn -join “, “)
}
}
$t | Out-GridView -Title “Users Without MFA Registered”
Note that the “MethodsRegistered” column will likely be blank, as these are non-MFA users.
Also, you are likely only interested in enabled accounts
I’m not displaying the output in this case, as it’s essentially a list of actual user accounts.
Give this a try, let us know in the comments if you find some unexpected folks who skated by the MFA login requirement ….
===============
Rob VandenBrink
[email protected]
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.