Important Update (2026): The legacyMSOnlinePowerShell module referenced in the original version of this article has been officially retired and no longer functions. > Below is the modern, production-grade equivalent using the Microsoft Graph PowerShell SDK (Microsoft.Graph.Reports/Microsoft.Graph.Identity.SignIns).
Modern Method: Export MFA Registration Details via Microsoft Graph SDK
With the Microsoft Graph PowerShell SDK, you can query Entra ID authentication methods directly using Get-MgReportAuthenticationMethodUserRegistrationDetail. This cmdlet provides the full registration status, default MFA method, and capable authentication methods across your tenant.
POWERSHELL
# Connect with required report permissions
Connect-MgGraph -Scopes "Reports.Read.All", "UserAuthenticationMethod.Read.All" -NoWelcome
$ExportFile = "MFA_Registration_Report_$(Get-Date -Format 'yyyyMMdd').csv"
Write-Host "Querying Entra ID Authentication Methods Registration details..." -ForegroundColor Cyan
# Fetch all user authentication registration details
$mfaDetails = Get-MgReportAuthenticationMethodUserRegistrationDetail -All
$report = foreach ($user in $mfaDetails) {
[PSCustomObject]@{
UserPrincipalName = $user.UserPrincipalName
IsMfaRegistered = $user.IsMfaRegistered
IsMfaCapable = $user.IsMfaCapable
IsPasswordlessCapable = $user.IsPasswordlessCapable
DefaultMfaMethod = $user.DefaultMfaMethod
MethodsRegistered = ($user.MethodsRegistered -join ", ")
IsSmsRegistered = ($user.MethodsRegistered -contains "mobilePhone")
IsAuthAppRegistered = ($user.MethodsRegistered -contains "microsoftAuthenticatorPush")
IsFido2Registered = ($user.MethodsRegistered -contains "fido2")
}
}
$report | Export-Csv -Path $ExportFile -NoTypeInformation
Write-Host "Report exported successfully to: $ExportFile" -ForegroundColor Green
Historical Reference: Legacy MSOnline Method (Pre-Deprecation)
The section below is preserved for historical context and documentation.
This script originally generated a report of the MFA method used by the users in your organization using the legacy MSOnline module (Get-MsolUser).
The methods available were:
PhoneAppOTPPhoneAppNotificationTwoWayVoiceMobileOneWaySMS
POWERSHELL
#-------------------------------------------------------
# Author: Sunil Chauhan
# Email: [email protected]
# Note: Requires legacy MSOnline (Deprecated)
# -------------------------------------------------------
$ExporttoFile = "MFA_Method_Used_report.csv"
$users = Get-MsolUser -All
$report = @()
Foreach ($Ms in $users) {
$Report += "" | select @{N="upn";E={$ms.UserPrincipalName}},
@{N="Title";E={$ms.title}},
@{N="PhoneAppOTP";E={($MS.StrongAuthenticationMethods | ? {$_.MethodType -eq "PhoneAppOTP"}).IsDefault}},
@{N="PhoneAppNotification";E={($MS.StrongAuthenticationMethods | ? {$_.MethodType -eq "PhoneAppNotification"}).IsDefault}},
@{N="TwoWayVoiceMobile";E={($MS.StrongAuthenticationMethods | ? {$_.MethodType -eq "TwoWayVoiceMobile"}).IsDefault}},
@{N="OneWaySMS";E={($MS.StrongAuthenticationMethods | ? {$_.MethodType -eq "OneWaySMS"}).IsDefault}}
}
$report | Export-Csv $ExporttoFile -NoTypeInformation