Auditing Entra ID MFA Gaps with PowerShell and Microsoft Graph

Overview: Auditing Entra ID MFA Rollout Gaps

Multi-factor authentication (MFA) is a cornerstone of modern identity security, yet comprehensive rollout and ongoing adherence remain a challenge for many organizations. A recent SANS ISC diary entry highlights a practical PowerShell script designed to help administrators identify users in Microsoft Entra ID (formerly Azure AD) who have not yet registered for MFA or are utilizing less secure authentication methods. This tool addresses a common operational blind spot: the users who “skated by” during initial MFA implementations, providing a quick way to pinpoint and remediate these security gaps according to SANS ISC Diary.

Technical Analysis: PowerShell Script for MFA Auditing

The provided script leverages PowerShell in conjunction with the Microsoft Graph API, specifically utilizing the Microsoft.Graph.Beta module. This module grants access to advanced reporting capabilities, including the Get-MgBetaReportAuthenticationMethodUserRegistrationDetail cmdlet. This cmdlet is essential for retrieving granular details about user authentication methods.

The core functionality of the script involves several steps:

• Module Import and Connection: It starts by importing the Microsoft.Graph.Beta.Reports module and connecting to Microsoft Graph with AuditLog.Read.All and User.Read.All scopes. These permissions are necessary to query authentication method registration details and user account status.
• Data Collection: The script then executes Get-MgBetaReportAuthenticationMethodUserRegistrationDetail -All to fetch comprehensive MFA registration data for all users.
• Filtering for Non-MFA Users: A critical step is filtering this data to identify Entra ID users without MFA registration. This is achieved by piping the results to Where-Object { $_.IsMfaRegistered -eq $false }.
• User Detail Enrichment: For each identified non-MFA user, the script retrieves additional account details such as Id and AccountEnabled status using Get-MgUser. This helps administrators understand if the non-MFA user account is active.
• Output Generation: Finally, it constructs custom PowerShell objects containing UserPrincipalName, DisplayName, AccountEnabled status, and any MethodsRegistered, then presents this information, optionally in a grid view for easy review.

Beyond simply finding non-MFA users, the article also suggests modifying the script to detect weak MFA methods Microsoft Graph reports. Administrators can adapt the Where-Object clause to look for users with IsMfaRegistered -eq $true but whose registered methods include less secure options like “SMS” or “voiceMobile” (voice callback). This detailed auditing capability is crucial for organizations aiming to harden their MFA posture beyond basic registration.

Actionable Recommendations and Mitigations

Organizations should prioritize the comprehensive auditing of their MFA implementations within Microsoft Entra ID. The PowerShell script outlined above offers a direct and efficient way to pinpoint potential vulnerabilities arising from incomplete MFA enrollment or the use of less secure authentication methods.

Key recommendations for defenders include:

• Implement and Regularise Audits: Regularly execute this PowerShell script for MFA auditing across your Entra ID environment. Integrate this into a routine security hygiene checklist to catch newly created accounts or accounts that may have temporarily bypassed MFA requirements.
• Enforce Strong MFA Policies: Once identified, ensure that all active user accounts are registered for MFA. Prioritize stronger authentication methods like authenticator apps (e.g., Microsoft Authenticator) or FIDO2 security keys over SMS or voice calls, which are susceptible to phishing and SIM-swapping attacks.
• Review Account Enablement: Pay close attention to the AccountEnabled status of users identified as non-MFA registered. Disabled accounts may not pose an immediate threat, but active accounts without MFA are critical risks that require immediate attention.
• Educate and Communicate: Provide clear guidance and support to users on why MFA is mandatory and how to register for and use approved strong MFA methods. Address any user-specific challenges that might contribute to MFA bypasses.
• Monitor Microsoft Graph Beta Changes: Since the script uses beta Graph commands, be aware that these cmdlets might change or be deprecated in future stable releases. Stay informed about Microsoft Graph API updates to ensure your auditing scripts remain functional.

By actively using tools like this, security teams can proactively strengthen their identity and access management posture, significantly reducing the attack surface related to credential compromise in cloud environments.

Related: Analysis of Obfuscated PowerShell Loaders Delivering Remcos RAT, Cybersecurity M&A Trends: Key Acquisitions in July 2026