# Auditing Entra ID MFA Gaps with PowerShell and Microsoft Graph

> A new PowerShell script helps security teams identify Microsoft Entra ID users not registered for MFA or using weaker authentication methods.

- Published: 2026-08-21T08:32:39.000Z
- Severity: info
- Category: Threat Intel
- Tags: Microsoft Entra ID, MFA, PowerShell, Identity Access, Microsoft Graph
- Author: Runtime Rebel Intel
- Primary source: https://isc.sans.edu/diary/rss/33272
- Canonical: https://runtimerebel.com/blog/auditing-entra-id-mfa-gaps-with-powershell-and-microsoft-graph

## Key points

- Script helps identify Microsoft Entra ID users not registered for MFA or using weaker methods.
- Affected systems are Microsoft Entra ID (Azure AD) environments with incomplete MFA rollout.
- Use the provided PowerShell script to audit and enforce MFA registration policies today.

## Overview: Auditing Entra ID [MFA](/glossary#mfa) Rollout Gaps

Multi-factor authentication (MFA) is a cornerstone of modern identity security, yet comprehensive rollout and ongoing adherence remain a challenge for many organizations. A recent SANS ISC diary entry highlights a practical PowerShell script designed to help administrators identify users in Microsoft Entra ID (formerly Azure AD) who have not yet registered for MFA or are utilizing less secure authentication methods. This tool addresses a common operational blind spot: the users who "skated by" during initial MFA implementations, providing a quick way to pinpoint and remediate these security gaps according to [SANS ISC Diary](https://isc.sans.edu/diary/rss/33272).

## Technical Analysis: PowerShell Script for MFA Auditing

The provided script leverages PowerShell in conjunction with the Microsoft Graph [API](/glossary#api), specifically utilizing the `Microsoft.Graph.Beta` module. This module grants access to advanced reporting capabilities, including the `Get-MgBetaReportAuthenticationMethodUserRegistrationDetail` cmdlet. This cmdlet is essential for retrieving granular details about user authentication methods.

The core functionality of the script involves several steps:
*   **Module Import and Connection:** It starts by importing the `Microsoft.Graph.Beta.Reports` module and connecting to Microsoft Graph with `AuditLog.Read.All` and `User.Read.All` scopes. These permissions are necessary to query authentication method registration details and user account status.
*   **Data Collection:** The script then executes `Get-MgBetaReportAuthenticationMethodUserRegistrationDetail -All` to fetch comprehensive MFA registration data for all users.
*   **Filtering for Non-MFA Users:** A critical step is filtering this data to **identify Entra ID users without MFA** registration. This is achieved by piping the results to `Where-Object { $_.IsMfaRegistered -eq $false }`.
*   **User Detail Enrichment:** For each identified non-MFA user, the script retrieves additional account details such as `Id` and `AccountEnabled` status using `Get-MgUser`. This helps administrators understand if the non-MFA user account is active.
*   **Output Generation:** Finally, it constructs custom PowerShell objects containing `UserPrincipalName`, `DisplayName`, `AccountEnabled` status, and any `MethodsRegistered`, then presents this information, optionally in a grid view for easy review.

Beyond simply finding non-MFA users, the article also suggests modifying the script to **detect weak MFA methods Microsoft Graph** reports. Administrators can adapt the `Where-Object` clause to look for users with `IsMfaRegistered -eq $true` but whose registered methods include less secure options like "SMS" or "voiceMobile" (voice callback). This detailed auditing capability is crucial for organizations aiming to harden their MFA posture beyond basic registration.

## Actionable Recommendations and Mitigations

Organizations should prioritize the comprehensive auditing of their MFA implementations within Microsoft Entra ID. The PowerShell script outlined above offers a direct and efficient way to pinpoint potential vulnerabilities arising from incomplete MFA enrollment or the use of less secure authentication methods.

Key recommendations for defenders include:
*   **Implement and Regularise Audits:** Regularly execute this **PowerShell script for MFA auditing** across your Entra ID environment. Integrate this into a routine security hygiene checklist to catch newly created accounts or accounts that may have temporarily bypassed MFA requirements.
*   **Enforce Strong MFA Policies:** Once identified, ensure that all active user accounts are registered for MFA. Prioritize stronger authentication methods like authenticator apps (e.g., Microsoft Authenticator) or FIDO2 security keys over SMS or voice calls, which are susceptible to [phishing](/glossary#phishing) and SIM-swapping attacks.
*   **Review Account Enablement:** Pay close attention to the `AccountEnabled` status of users identified as non-MFA registered. Disabled accounts may not pose an immediate threat, but active accounts without MFA are critical risks that require immediate attention.
*   **Educate and Communicate:** Provide clear guidance and support to users on why MFA is mandatory and how to register for and use approved strong MFA methods. Address any user-specific challenges that might contribute to MFA bypasses.
*   **Monitor Microsoft Graph Beta Changes:** Since the script uses beta Graph commands, be aware that these cmdlets might change or be deprecated in future stable releases. Stay informed about Microsoft Graph API updates to ensure your auditing scripts remain functional.

By actively using tools like this, security teams can proactively strengthen their identity and access management posture, significantly reducing the [attack surface](/glossary#attack-surface) related to credential compromise in cloud environments.

**Related:** [Analysis of Obfuscated PowerShell Loaders Delivering Remcos RAT](/blog/analysis-of-obfuscated-powershell-loaders-delivering-remcos-rat), [Cybersecurity M&A Trends: Key Acquisitions in July 2026](/blog/cybersecurity-m-a-trends-key-acquisitions-in-july-2026)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/auditing-entra-id-mfa-gaps-with-powershell-and-microsoft-graph