Get authentication methods registered by users

[merill]

# Get the authentication methods registered by all the users in the tenant
Get-MgBetaReportCredentialUserRegistrationDetail -All

# Get the authentication method details for a single user
Get-MgBetaReportCredentialUserRegistrationDetail -Filter "UserPrincipalName eq '<upn>'" -All

# Create a csv of all the users and their authentication methods 
Get-MgBetaReportCredentialUserRegistrationDetail -All | Select-Object Id, UserPrincipalName, UserDisplayName, IsCapable, IsEnabled, IsRegistered, IsMfaRegistered,@{n="AuthMethods";e={$_.AuthMethods -join ","}} | Export-Csv ./UserMfa.csv

[mlibenocg]

I found that I must use the beta profile. After Connect-MGraph, execute the line, Select-MgProfile Beta

[sergiopadure]

Get-MgReportCredentialUserRegistrationDetail : Calling principal does not have required MSGraph permissions Reports.Read.All
At line:1 char:1
+ Get-MgReportCredentialUserRegistrationDetail -All
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: ({ Top = 100, Sk...ndProperty =  }:<>f__AnonymousType2`8) [Get-MgReportCre...tionDetail_List], RestException`1
    + FullyQualifiedErrorId : Authentication_MSGraphPermissionMissing,Microsoft.Graph.PowerShell.Cmdlets.GetMgReportCredentialUserRegistrationDetail_List

I get this error even after connecting with Connect-MgGraph -Scopes "Directory.ReadWrite.All"

[mlibenocg]

The error message specifies that you require Reports.ReadAll. Try adding or using the Reports.ReadAll scope when you connect. Client Confidential - OCG Internal From: Padure Sergio ***@***.***> Sent: Friday, February 10, 2023 8:08 AM To: msgraph/powershell ***@***.***> Cc: Michael Liben ***@***.***>; Comment ***@***.***> Subject: [EXTERNAL]Re: [msgraph/powershell] Get authentication methods registered by users (Discussion #41) [EXTERNAL] Use caution opening attachments, clicking links, or responding. Get-MgReportCredentialUserRegistrationDetail : Calling principal does not have required MSGraph permissions Reports.Read.All At line:1 char:1 + Get-MgReportCredentialUserRegistrationDetail -All + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: ({ Top = 100, Sk...ndProperty = }:<>f__AnonymousType2`8) [Get-MgReportCre...tionDetail_List], RestException`1 + FullyQualifiedErrorId : Authentication_MSGraphPermissionMissing,Microsoft.Graph.PowerShell.Cmdlets.GetMgReportCredentialUserRegistrationDetail_List I get this error even after connecting with Connect-MgGraph -Scopes "Directory.ReadWrite.All" - Reply to this email directly, view it on GitHub<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Forgs%2Fmsgraph%2Fdiscussions%2F41%23discussioncomment-4934921&data=05%7C01%7Cmichael.liben%40oxfordcomputergroup.com%7C3dc5a52a4c3c4b2ae13b08db0b67cfac%7C9505d3230e794ceab1d35475ecc368b6%7C0%7C0%7C638116312763189874%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=juoCdoO%2F4XKonaZ9FRkwJ2bt23g5fNVSdes%2F9nxG%2FHw%3D&reserved=0>, or unsubscribe<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAO3KH6XBEBXXZC3BVGLGYLLWWY4SJANCNFSM5W7AFKGQ&data=05%7C01%7Cmichael.liben%40oxfordcomputergroup.com%7C3dc5a52a4c3c4b2ae13b08db0b67cfac%7C9505d3230e794ceab1d35475ecc368b6%7C0%7C0%7C638116312763189874%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=WfkOHNkRjRm7MMBA3AvIk0MNOqzTSmxmRu%2F03I5hhzA%3D&reserved=0>. You are receiving this because you commented.Message ID: ***@***.******@***.***>> DISCLAIMER: The information contained in this message may be confidential and/or subject to legal privilege and is for the use of the intended recipient(s) only. Any unauthorized use, dissemination or copying of the information in this message is strictly prohibited. If you have received this message in error, please notify the sender immediately and delete this message.

[William-Francillette]

I saw a thread on twitter and thought I'll post my script here

# This script retrieves the count and detail of strong and standard authentication methods for all users
Connect-MgGraph -Scopes user.read.all,UserAuthenticationMethod.Read.All
Select-MgProfile beta

$authMethods = @{
    emailAuthenticationMethod = 'standard'
    fido2AuthenticationMethod = 'strong'
    microsoftAuthenticatorAuthenticationMethod = 'strong'
    passwordlessMicrosoftAuthenticatorAuthenticationMethod = 'strong'
    passwordAuthenticationMethod = 'standard'
    phoneAuthenticationMethod = 'standard'
    softwareOathAuthenticationMethod = 'strong'
    temporaryAccessPassAuthenticationMethod = 'strong'
    windowsHelloForBusinessAuthenticationMethod = 'strong'
}
$users = Get-MgUser -all
$userStrongAuthentications = @()
foreach ($user in $users)
{
    $userAuthMethods = (Get-MgUserAuthenticationMethod -UserId $user.id).AdditionalProperties.'@odata.type' -replace '#microsoft.graph.', ''
    $strongAuthMethods = $userAuthMethods | Where-Object {$authMethods.$_ -eq 'strong'}
    $standardAuthMethods = $userAuthMethods | Where-Object {$authMethods.$_ -eq 'standard'}
    $userStrongAuthentications += [pscustomobject][ordered]@{
        username = $user.UserPrincipalName
        userId = $user.Id
        strongAuthentication = $(if ($null -eq $strongAuthMethods){,@()}else{,[String[]]$strongAuthMethods})
        standardAuthentication = $(if ($null -eq $standardAuthMethods){,@()}else{,[String[]]$standardAuthMethods})
        strongAuthenticationCount = $(if ($null -eq $strongAuthMethods){0}else{$strongAuthMethods.count})
        standardAuthenticationCount = $standardAuthMethods.count

    }
}
$userStrongAuthentications

[c016smith]

I had to install/import the Microsoft.Graph.Beta.Reports module as well for the cmdlet 'Get-MgBetaReportCredentialUserRegistrationDetail' to be recognized, still couldn't get it to work with 'Get-MgReportCredentialUserRegistrationDetail'

[alenat10]

after setting scope permissions and switching mgprofile to Beta got the following message:
"Get-MgReportCredentialUserRegistrationDetail_List: Neither tenant is B2C or tenant doesn't have premium license"

[neilpaton]

Hi
When I use Get-MgReportCredentialUserRegistrationDetail against an account, it returns the following Auth Methods for a particular account
{email, mobilePhone, appNotification, appCode}
However, looking at the User Registration Details report in Entra console for the same account, I see the following Methods Registered
Email,Microsoft Passwordless phone sign-in,Windows Hello for Business,Passkey (other device-bound),Mobile phone,Microsoft Authenticator app (push notification),Software OATH token

I accept that not all methods registered are authentication methods, but I would have expected Windows Hello for Business, and maybe some others, to be in the Auth Methods list returned using Get-MgReportCredentialUserRegistrationDetail

I am specifically looking for a way to return all accounts which have WHfB registered.
I wrote a script, similar to the one above by William-Francillette, which goes through each user in our tenant and runs the commandlet Get-MgUserAuthenticationMethod, however it takes about 10 hours to query 70,000 users.
I was hoping to find something which ran more quickly.

[ittchmh]

You can use parallel execution to get the report much faster
As a hint, use jobs