PowerShell module that generates a risk-based report of user mutli-factor authentication registration methods.
Invoke-MFAMethodsReport was created to give administrators a quick and easy way to generate risk-based report of user multi-factor authentication registration methods. The report is sorted by risk, so administrators will be able to easily discern the most at risk users based on their MFA configuration, including if the user is registered, if they hold an administrative role in the tenant, all registered methods, and the user selected default method used to authenticate the user.
Allow filtering by risk to only output desired risk ratingsAdditional report output formats
<#
.SYNOPSIS
Generates a risk-based report of user mutli-factor authentication registration methods.
.DESCRIPTION
Returns information about users multi-factor authentication registered methods and assigns a risk rating based upon the strength of the authentication method. Can be run for all users, or targeted members of a given group.
.PARAMETER ReportScope
Scope of the report. Options are All or Group.
.PARAMETER ReportType
Desired Report Format. Options are CSV, XML, JSON, HTML, or None.
.PARAMETER TargetGroup
Only required when the ReportScope is Group. Takes the group DisplayName property and gathers the multi-factor registration info for all members.
.EXAMPLE
Execute-GenerateMFAMethodsReport -ReportScope All -reportType CSV
.EXAMPLE
Execute-GenerateMFAMethodsReport -ReportScope Group -reportType JSON
.INPUTS
System.String values for ReportScope, ReportType, and TargetGroup when required.
.OUTPUTS
Desired report output in the current users \Documents\MFA_Report folder
.LINK
https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-methods-activity
#>
The Microsoft Graph PowerShell module, and sufficient permissions to run the queries are required. The first time Microsoft Graph requests the necessary permissions, a Global Administrator must grant the permissions request on behalf of the tenant.
Reports.Read.All
Group.Read.All
GroupMember.Read.All
User.Read.All
Microsoft.Graph.Reports
Microsoft.Graph.Groups
PS C:\> git clone 'https://github.com/soteria-security/Invoke-MFAMethodsReport.git'
PS C:\> Import-Module ".\Invoke-MFAMethodsReport/Invoke-MFAMethodsReport/Invoke-MFAMethodsReport.psd1"
The module can be installed by copying the Invoke-MFAMethodsReport folder and its contents to C:\Users\<Your User>\Documents\WindowsPowerShell\Modules
# Return full set of results
PS C:\> Execute-GenerateMFAMethodsReport -ReportScope All -reportType CSV
# or
PS C:\> Execute-GenerateMFAMethodsReport -ReportScope Group -reportType JSON
# or
PS C:\> Execute-GenerateMFAMethodsReport -ReportScope Group -reportType HTML
# Return filtered risks only
PS C:\> Execute-GenerateMFAMethodsReport -ReportScope All -reportType None -riskLevel Critical
# or
PS C:\> Execute-GenerateMFAMethodsReport -ReportScope All -reportType None -riskLevel Critical, High
By selecting the report type 'None', all results will be output to stdout (your terminal)
[
{
"Name": "BOBBIE_ARNOLD",
"UPN": "[email protected]",
"MethodsRegistered": "",
"DefaultMethod": "none",
"IsAdmin": true,
"MFACapable": false,
"MFARegistered": false,
"IsSSPRCapable": false,
"IsSSPREnabled": false,
"IsSsprRegistered": false,
"Risk": "Critical"
},
{
"Name": "Lynne Robbins",
"UPN": "[email protected]",
"MethodsRegistered": "",
"DefaultMethod": "none",
"IsAdmin": false,
"MFACapable": false,
"MFARegistered": false,
"IsSSPRCapable": false,
"IsSSPREnabled": false,
"IsSsprRegistered": false,
"Risk": "High"
},
{
"Name": "MABEL_GOODWIN",
"UPN": "[email protected]",
"MethodsRegistered": "",
"DefaultMethod": "none",
"IsAdmin": false,
"MFACapable": false,
"MFARegistered": false,
"IsSSPRCapable": false,
"IsSSPREnabled": false,
"IsSsprRegistered": false,
"Risk": "High"
},
{
"Name": "MAJOR_FORBES",
"UPN": "[email protected]",
"MethodsRegistered": "",
"DefaultMethod": "none",
"IsAdmin": false,
"MFACapable": false,
"MFARegistered": false,
"IsSSPRCapable": false,
"IsSSPREnabled": false,
"IsSsprRegistered": false,
"Risk": "High"
}
]