Get authentication methods registered by users

[merill]

# Get the authentication methods registered by all the users in the tenant
Get-MgBetaReportCredentialUserRegistrationDetail -All

# Get the authentication method details for a single user
Get-MgBetaReportCredentialUserRegistrationDetail -Filter "UserPrincipalName eq '<upn>'" -All

# Create a csv of all the users and their authentication methods 
Get-MgBetaReportCredentialUserRegistrationDetail -All | Select-Object Id, UserPrincipalName, UserDisplayName, IsCapable, IsEnabled, IsRegistered, IsMfaRegistered,@{n="AuthMethods";e={$_.AuthMethods -join ","}} | Export-Csv ./UserMfa.csv

[mlibenocg]

I found that I must use the beta profile. After Connect-MGraph, execute the line, Select-MgProfile Beta

[sergiopadure]

Get-MgReportCredentialUserRegistrationDetail : Calling principal does not have required MSGraph permissions Reports.Read.All
At line:1 char:1
+ Get-MgReportCredentialUserRegistrationDetail -All
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: ({ Top = 100, Sk...ndProperty =  }:<>f__AnonymousType2`8) [Get-MgReportCre...tionDetail_List], RestException`1
    + FullyQualifiedErrorId : Authentication_MSGraphPermissionMissing,Microsoft.Graph.PowerShell.Cmdlets.GetMgReportCredentialUserRegistrationDetail_List

I get this error even after connecting with Connect-MgGraph -Scopes "Directory.ReadWrite.All"

[mlibenocg]

The error message specifies that you require Reports.ReadAll. Try adding or using the Reports.ReadAll scope when you connect. Client Confidential - OCG Internal From: Padure Sergio ***@***.***> Sent: Friday, February 10, 2023 8:08 AM To: msgraph/powershell ***@***.***> Cc: Michael Liben ***@***.***>; Comment ***@***.***> Subject: [EXTERNAL]Re: [msgraph/powershell] Get authentication methods registered by users (Discussion #41) [EXTERNAL] Use caution opening attachments, clicking links, or responding. Get-MgReportCredentialUserRegistrationDetail : Calling principal does not have required MSGraph permissions Reports.Read.All At line:1 char:1 + Get-MgReportCredentialUserRegistrationDetail -All + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: ({ Top = 100, Sk...ndProperty = }:<>f__AnonymousType2`8) [Get-MgReportCre...tionDetail_List], RestException`1 + FullyQualifiedErrorId : Authentication_MSGraphPermissionMissing,Microsoft.Graph.PowerShell.Cmdlets.GetMgReportCredentialUserRegistrationDetail_List I get this error even after connecting with Connect-MgGraph -Scopes "Directory.ReadWrite.All" - Reply to this email directly, view it on GitHub<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Forgs%2Fmsgraph%2Fdiscussions%2F41%23discussioncomment-4934921&data=05%7C01%7Cmichael.liben%40oxfordcomputergroup.com%7C3dc5a52a4c3c4b2ae13b08db0b67cfac%7C9505d3230e794ceab1d35475ecc368b6%7C0%7C0%7C638116312763189874%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=juoCdoO%2F4XKonaZ9FRkwJ2bt23g5fNVSdes%2F9nxG%2FHw%3D&reserved=0>, or unsubscribe<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAO3KH6XBEBXXZC3BVGLGYLLWWY4SJANCNFSM5W7AFKGQ&data=05%7C01%7Cmichael.liben%40oxfordcomputergroup.com%7C3dc5a52a4c3c4b2ae13b08db0b67cfac%7C9505d3230e794ceab1d35475ecc368b6%7C0%7C0%7C638116312763189874%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=WfkOHNkRjRm7MMBA3AvIk0MNOqzTSmxmRu%2F03I5hhzA%3D&reserved=0>. You are receiving this because you commented.Message ID: ***@***.******@***.***>> DISCLAIMER: The information contained in this message may be confidential and/or subject to legal privilege and is for the use of the intended recipient(s) only. Any unauthorized use, dissemination or copying of the information in this message is strictly prohibited. If you have received this message in error, please notify the sender immediately and delete this message.

[William-Francillette]

I saw a thread on twitter and thought I'll post my script here

# This script retrieves the count and detail of strong and standard authentication methods for all users
Connect-MgGraph -Scopes user.read.all,UserAuthenticationMethod.Read.All
Select-MgProfile beta

$authMethods = @{
    emailAuthenticationMethod = 'standard'
    fido2AuthenticationMethod = 'strong'
    microsoftAuthenticatorAuthenticationMethod = 'strong'
    passwordlessMicrosoftAuthenticatorAuthenticationMethod = 'strong'
    passwordAuthenticationMethod = 'standard'
    phoneAuthenticationMethod = 'standard'
    softwareOathAuthenticationMethod = 'strong'
    temporaryAccessPassAuthenticationMethod = 'strong'
    windowsHelloForBusinessAuthenticationMethod = 'strong'
}
$users = Get-MgUser -all
$userStrongAuthentications = @()
foreach ($user in $users)
{
    $userAuthMethods = (Get-MgUserAuthenticationMethod -UserId $user.id).AdditionalProperties.'@odata.type' -replace '#microsoft.graph.', ''
    $strongAuthMethods = $userAuthMethods | Where-Object {$authMethods.$_ -eq 'strong'}
    $standardAuthMethods = $userAuthMethods | Where-Object {$authMethods.$_ -eq 'standard'}
    $userStrongAuthentications += [pscustomobject][ordered]@{
        username = $user.UserPrincipalName
        userId = $user.Id
        strongAuthentication = $(if ($null -eq $strongAuthMethods){,@()}else{,[String[]]$strongAuthMethods})
        standardAuthentication = $(if ($null -eq $standardAuthMethods){,@()}else{,[String[]]$standardAuthMethods})
        strongAuthenticationCount = $(if ($null -eq $strongAuthMethods){0}else{$strongAuthMethods.count})
        standardAuthenticationCount = $standardAuthMethods.count

    }
}
$userStrongAuthentications

[c016smith]

I had to install/import the Microsoft.Graph.Beta.Reports module as well for the cmdlet 'Get-MgBetaReportCredentialUserRegistrationDetail' to be recognized, still couldn't get it to work with 'Get-MgReportCredentialUserRegistrationDetail'

[alenat10]

after setting scope permissions and switching mgprofile to Beta got the following message:
"Get-MgReportCredentialUserRegistrationDetail_List: Neither tenant is B2C or tenant doesn't have premium license"