Get MFA Status of Office 365 users with PowerShell

61 thoughts on “Get MFA Status of Office 365 users with PowerShell”

1. Loving the script, been looking for something like this for a while.

   Did try to modify it to work for partners, repeatedly trying to create lists for dozens of managed companies should be a crime.

   Tried creating a loop around your code to query Get-MsolPartnerContract or even Get-PartnerCustomer from the PartnerCenter module but I either get blank outputs or no output at all. Both allow for Get-MsolUser but when I try to combine everything, no luck.

   I can do Get-MsolPartnerContract | Get-MsolUser -EnabledFilter EnabledOnly to get all users from all tenants but not Get-MsolPartnerContract | Get-MsolUser -EnabledFilter EnabledOnly | Where-Object {$_.IsLicensed -eq $isLicensed} – or the rest of your script from line 211.

   Am I missing something simple?

   • I just tried it and seems to work fine on my end with multiple tenants

     $MsolUsers = Get-MsolPartnerContract | Get-MsolUser -EnabledFilter EnabledOnly | Where-Object {$_.IsLicensed -eq $true} | Sort-Object UserPrincipalName

     • Thanks! Shouldn’t have been trying late at night. Got it to work now by only changing this one line.

       Now to figure out why all the admin accounts are showing up as not being an admin. 🙂

       • The script matches the email address with the userprincipal name. That may not match in your situation.

         if ($listAdmins -and $admins.EmailAddress -match $MsolUser.UserPrincipalName) {$true} else {"-"}

         • Think it has to do with the if (($listAdmins) -or ($adminsOnly)) { } function.

           That won’t query the other tenants, just my own. And I don’t see a quick fix to combine it with Get-MsolPartnerContract

           Will do without. This has more than helped me along.

         • That is possible, but you will have to rebuild the script a bit. To get the admins from the other tenants, you could add something like this:

           get-msolrole -TenantId $tenant.TenantId | %{$role = $_.name; Get-MsolRoleMember -RoleObjectId $_.objectid -TenantId $tenant.TenantId} | Where-Object {$_.isLicensed -eq $true} | select @{Name="Role"; Expression = {$role}}, DisplayName, EmailAddress, ObjectId | Sort-Object -Property EmailAddress -Unique

2. Thanks for this article Ruud!

   I will use your script to gather some details. Your article was the first I found in a search.

   Greetings from the USA. On my next visit to NL I will need to offer to buy you a beer!

3. I ran the script in powershell ISE by hitting run and it disabled all users that had already MFA enabled? can you help figure out what line cause all MFA enabled users to go Enabled = False?

   • I double-checked the script (in the article and on GitHub) and there is no set command in it, only get.

     So it’s impossible that this script is changing the MFA settings of your users. Are you sure that the settings are disabled, and not that the reporting is maybe wrong?

4. Guest users are missing.

   • Have you set -Licenend:$false ? Otherwise, it will only get licensed users.

     • -IsLicensed:$false
       Did the trick.

5. Thanks for this. Its making my rollout of MFA a lot easier.

6. Hi Rudy,

   Thank you for this excellent script. Is there a way I can run this against users who are members of an AAD group?

   Thanks!

   • Hi Rudy,

     I think I’ve figure it out.

     Get-MsolGroup -SearchString “MyAADGroup”
     Get-MsolGroupMember -GroupObjectId 374ae704-8425-4140-a270-9b8a05222510 | ForEach-Object { .\Get-MFAStatus.ps1 -UserPrincipalName $_.EmailAddress } | Export-CSV c:\temp\output.csv -noTypeInformation

     Thanks again for this excellent resource.

7. I love this script, I took pieces of this and created a GUI for doing this. Since O365 only allows global admins the ability to manage MFA from users within the O365 admin window.

   So I have a PowerShell GUI that will get Status, Enable, Disable, Enforce, Reset, Revoke, or Refresh. Thanks for this excellent guide.

   • More details on the GUI?

8. Hi all.

   There was a previous comment on WHEN MFA was enabled. I generally use the RememberDevicesNotIssuedBefore value from the StrongAuthenticationRequirements attribute

9. Would there be a way to filter by a particular license? I am at a school and only do MFA for employees. The students have a different license and that is easiest way to differentiate. Thanks for a great script.

   • You will need to change line 211 and replace {$_.IsLicensed -eq $isLicensed} to

     
{($_.licenses).AccountSkuId -match "DEVELOPERPACK_E5"}


     Change Developerpack_e5 to your license SKU:
     Get-msolaccountsku

10. Amazing script, however for some reason it ignores all guest accounts. Am I missing something or it would requires a separate switch to be coded into the script, please?

    • add the parameter -Licenend or -Licenend:$false to get all user without license

      • -IsLicensed:$false

11. Most of our tenants have unlicensed global admins, they don’t show if I run it with -adminsOnly switch. Is there a way to run the report so it shows both licensed and unlicensed users on the same report?

    Would be really great if the report included all users, licensed and unlicensed, and the licensed / unlicensed status was just another column that we could filter on in excel

12. Is there any way to include the sign-in methods for each user (Authenticator App, Phone, etc.), and also indicate which one is the Default Sign-in method?

    • I have added it in the last update. The report will show the default method and all configured methods for each user.

13. Any way to get the date that MFA was enabled on the accounts?

    • Nope, not that I can find.

14. Amazing, but it asks for auth every time you run it. My other script doesnt, it just reports after the initial PS auth logon. Can this be resolved?

    • I have updated the script. It will now check for an existing MSOL connection.

15. Is there an option to show if there are more methods used to setup MFA? For self service password reset we need two methods, but would like to see which persons have setup more than one method. Currently the script it only shows one method even if two or more methods have been added.

    • I have updated the script so it now lists all configured MFA types for each user.

16. I saved the file and I currently run it using the .\Get-MFAStatus.ps1. When I try to just run it directly from ISE, it will start running the program without allowing me to enter any parameters.

    Is there a way to set this up where I can just run it like a regular command? Ideally I am trying to use this as a function that loads when I startup PowerShell and add it to a loop to do a check but it won’t work that way.

    • You will need to use your PowerShell Profile for this. I had an old article about that, but it was outdated. So just written a new one with all the details.

17. Hey Rudy
    thanks for the script, its very helpful.
    I’ve noticed an issue where it doesn’t identify the admins correctly, unfortunately my PowerShell skills are not good enough to actually fix it.
    I found another script which does a great job of identifying the admins, but lacks the ability to determine the MFA status.

    • I have updated the script, it will now get all licensed users with a admin role and mark them correctly as admin.

18. Great script, thank you! We have a subset of users that are members of a NonMFAUsers group that are not required to use MFA. How would I use this script to export MFA Licensed/Disabled users, EXCEPT those that are members of our NonMFAUsers group?

    • You will need to get all the users first and then get the msol details. Something like this in line 205:

      $group = Get-ADGroup NonMFAUsers
$MsolUsers = Get-ADUser -Properties memberof -filter 'enabled -eq $true' | Where-Object {$group.DistinguishedName -notin $_.memberof} | Get-MsolUser -UserPrincipalName $_.UserPrincipalName

19. Hi,

    Great script, thanks alot! Just one thing that I noticed and I am not sure if it is by design or not. If a user has been enabled for MFA and then for whatever reason been disabled again the script will still return that user as enabled.

20. Is there an option to break this down based on say getting the status of a single user for checking for enabled / enforced / disabled? I am new to powershell and am looking at pulling info for single users

    • You can run it for a single user with:

      Get-MFAStatus.ps1 -UserPrincipalName '[email protected]'

21. Hi All,
    In my tenant i have different license types A1 till A5
    i would like assistance whereas i can pull report of users that have mfa enforced on them and which license type a person has been assigned.
    I have used this powershell command to retrieve information about mfa status
    Connect-MsolService
    $Users = Get-MsolUser -all
    $Users | select DisplayName,Title,State,@{N=’Email’;E={$_.UserPrincipalName}},@{N=’StrongAuthenticationRequirements’;E={($_.StrongAuthenticationRequirements.State)}} | Export-Csv -NoTypeInformation C:\temp\Users.csv

    but the issue is when i try to add license type no results found

    • You will need to use Get-MsolUser | Where-Object {($_.licenses).AccountSkuId -match "EnterprisePremium"}. To get the correct accountSKuId you can lookup the license names with Get-MsolAccountSku

22. Hi, Thanks for the automation script. I have one question, does this script reports the users that are enabled the MFA using conditional access policy?

    • No, it’s pretty difficult to get an accurate report of the MFA Status based on the conditional access. What you can do is add StrongAuthenticationUserDetails to the PSCustomobject:

      MFADevice = $MsolUser.StrongAuthenticationMethods

      This should list the device/method that the user has used to approve the MFA request. But as said, it’s not really accurate.

23. Nice script (Thanks!!) and produces a good amount of information for the analysis I am trying to do.
    One problem is that it doesn’t return all the users – the environment I am working on has 1298 licensed users but only 939 show up in the Got MFA list when running this script… I switched it to return those without MFA and it came back with 139 users which doesn’t add up. The number of users with MFA plus the number without should add up to the actual number of licensed users in the environment… what am I missing?

    Some History: We enabled MFA using “Security Defaults” an I’m suspicious that SD doesn’t work as well as one would expect….

    Additionally, the -isadmin feature of this script doesn’t seem to work for me as it doesn’t report whether user is admin…. users that ARE admin don’t show up marked as admin

    • Andy, I ran into the same issue and was able to get around it by adjusting the “[int]$MaxResults = ” line. It is set to only return the top 1000 results by default so I adjusted it up to 10000 and was able to get full results in my tenant, though you may need to go higher depending on the size of your tenant. Can’t speak to the -isadmin feature though as I did not use that, however when I just ran the full report (the script with no options other than exporting to csv) it did accurately identify which accounts were admins in the report.

24. Get list of users who have registered their MFA and export it.

    Get-MsolUser -All | where {$_.StrongAuthenticationMethods -ne $null} | Select-Object -Property UserPrincipalName | Sort-Object userprincipalname | Export-csv C:\temp\Filename.csv

25. I saved the script to c:\temp and ran it. Doesn’t appear to do anything and when I then do “Get-MFAStatus -withoutMFAonly it says the Get-MFAStatus is not recognized.
    I also ran Get-MFAstatus.ps1 -withoutMFAonly and nothing happened.

    • Yes, this is a function, which I used in a PowerShell runbook. If you want to run the script standalone, then remove the function wrapper (First and last line from the script). Then you can just run Get-mfastatus.ps1

26. FYI, you need to run the script, which installs the function. THEN you can run the
    get-mfastatus function.

27. Hello. I’ve made all steps. but, I have an error
    Get-MFAStatus “is not recognized as the name of cmdlet, function, script file
    or executable program.

    • Just refer to the file .\get-mfastatus.ps1.

28. What if MFA is enabled using conditional access policies and the user is part of that policy but StrongAuthenticationMethods for the user is false ? It will be reported as a false positive.

    • If you are using conditional access policies then you don’t need to force MFA. You can maybe alter the script to check if the user is a member of the conditional access policy.

29. Hi,
    I’m connected with MsolService and try to start the script but nothing happened.

    • Did you have saved the script in a ps1 file? If you have saved it as GetMFAStatus.ps1 then you can call the script from PowerShell with GetMFAStatus.ps1 -withOutMFAOnly

      • Where do we need to save this file?
        I saved it to D:\try\MFAStatus.ps1
        do I need to go into that directory and run the command?

        • Yes, just open PowerShell in that directory and run the script with the commands > MFAStatus.ps1 -withoutMFAOnly

30. This is pretty great, thank you. I’m attempting to get a list of users with a specific Strong Authentication Method Type set specifically to “PhoneAppNotification”. As it turns out, Microsoft offers users the ability to put their cell phone numbers on their accounts, which get registered as a Strong Authentication Method, even when MFA isnt configured. Because of that I have thousands of users that get returned when basic Strong Authentication queries are run.

    • Hi Jason,

      You can use the following code to only list the users with PhoneAppNotification:

      
$msolUsers = get-msoluser -EnabledFilter EnabledOnly -MaxResults 1000

      foreach ($MsolUser in $MsolUsers) {
      $methodType = $MsolUser.StrongAuthenticationMethods | Where-Object {$_.IsDefault -eq $true} | Select-Object -ExpandProperty MethodType

      # List only the user that don't have MFA enabled
if ($methodType -eq 'PhoneAppNotification') {
write-host $MsolUser.UserPrincipalName
}
}