M365-005 · Script
MFA Enrollment and Status
Reports which Microsoft 365 users have registered for multifactor authentication (MFA), and how MFA is enforced.
What it does
Read-only. Saves a dated CSV in the Reports folder with each enabled user's MFA registration, registered methods, default method, passwordless and self-service password reset readiness, and admin status. Also reports how MFA is enforced in the tenant: whether security defaults are on, and which enabled Conditional Access policies require MFA. Flags: Admin without MFA, No MFA registered.
Requirements
Microsoft Graph PowerShell SDK, installed by you from the PowerShell Gallery (not included). Graph application permissions: AuditLog.Read.All, UserAuthenticationMethod.Read.All, User.Read.All, Policy.Read.All. Registration details need Microsoft Entra ID P1 or higher. Windows PowerShell 5.1 or PowerShell 7.
How to run it
- Run from: an admin workstation or scheduled task with the Microsoft modules installed and app sign-in configured
- This is an admin script for your Microsoft 365 tenant, not a per-device endpoint script
- User interaction: none with app-only sign-in
- Schedule: run on demand, or weekly for reports
Settings
| Name | What it does | Options | Default |
|---|---|---|---|
| AdminsOnly | Only report accounts with admin roles. | False | |
| IncludeGuests | Include guest accounts (excluded by default). | False | |
| AlertOn | When to exit 1: AdminsWithoutMfa (default), AnyWithoutMfa, or Never. | AdminsWithoutMfa, AnyWithoutMfa, Never | AdminsWithoutMfa |
| TenantId | Directory (tenant) ID, for unattended app-only sign-in. | ||
| ClientId | Application (client) ID of your app registration. | ||
| CertificateThumbprint | Thumbprint of the certificate uploaded to the app registration. | ||
| UseExistingSession | Use a Microsoft Graph session you already opened with Connect-MgGraph. | False |
Exit codes
- 0 = Completed, no findings for the -AlertOn setting
- 1 = Users without MFA found (per -AlertOn)
- 2 = Script error (see log)
Testing steps
- Run it on one test tenant or small OU and check the output and log.
- Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
- Roll out to a small group next, then everyone.
Rollback steps
Report only. It saves a CSV and changes nothing else.
Version and change log
| Version | Date | Changes |
|---|---|---|
| 1.0.0 | November 2026 | First release. |