Security & Threat Intelligence · 21.08.2026, 02:31 UTC
Who Got Missed in the MFA Rollout? More Powershell + Graph + Entra scripting!, (Fri, Aug 21st)
| Schweregrad | info |
|---|---|
| Kategorie | Security & Threat Intelligence |
| Quelle | SANS Internet Storm Center ↗ |
| Veröffentlicht | 21.08.2026 UTC |
Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
In every MFA rollout, there will come a time where you think you are closing in on "done", and some automation to list what's left would be handy. Something quicker than scrolling through the web interface through thousands of accounts ... This is that method. Also, remember when we discussed yesterday about the beta graph commands in the Microsoft.Graph.Beta library? We'll use one of those beta commands here!
# import, if it's not already there Import-Module -Name Microsoft.Graph.Beta.Reports
# with the necessary auditing scope Connect-MgGraph -Scopes "AuditLog.Read.All", "User.Read.All"
$AllMFADetails = Get-MgBetaReportAuthenticationMethodUserRegistrationDetail -All
# We're only interested in users who are NOT yet registered for MFA $NonMFAUsers = $AllMFAdetails | Where-Object { $_.IsMfaRegistered -eq $false }
$t = foreach ($User in $NonMFAUsers) { # user by user, collect account details (primary if it's enabled) # then construct the userobj record $UserObj = Get-MgUser -UserId $User.Id -Select Id, AccountEnabled
[PSCustomObject]@{ "UserPrincipalName" = $User.UserPrincipalName "DisplayName" = $User.UserDisplayName "AccountEnabled" = $UserObj.AccountEnabled "MethodsRegistered" = ($User.UserPreferredMethodForSignIn -join ", ") } }
$t | Out-GridView -Title "NON-MFA Users"
Note that the "MethodsRegistered" column will likely be blank, as these are non-MFA users. Also, you are likely only interested in enabled accounts
I'm not displaying the output in this case, as it's essentially a …