Microsoft Entra Admin Center

# Register PSGallery
# Install the PSGallery module if this is first use.
Register-PackageSource -ErrorAction SilentlyContinue -Name PSGallery -ProviderName PowerShellGet -Trusted

# Install the MSOnline module if this is first use.
Install-Module -Force -Name MsOnline

# Add the MSOnline module to the PowerShell session
Import-Module MsOnline

Connect-MsOlService
# Login with the Microsoft 365 Admin Account.

$Users = Get-MsolUser -All | ? { $_.UserType -ne "Guest" }
$Report = [System.Collections.Generic.List[Object]]::new() # Create output file
$NotMFAUser = [System.Collections.Generic.List[Object]]::new() # Create output file
$MFANotUsed = [System.Collections.Generic.List[Object]]::new() # Create output file
ForEach ($User in $Users) {
    $MFAEnforced = $User.StrongAuthenticationRequirements.State
    $MFAPhone = $User.StrongAuthenticationUserDetails.PhoneNumber
    $DefaultMFAMethod = ($User.StrongAuthenticationMethods | ? { $_.IsDefault -eq "True" }).MethodType
    If (($MFAEnforced -eq "Enforced") -or ($MFAEnforced -eq "Enabled")) {
        Switch ($DefaultMFAMethod) {
            "OneWaySMS" { $MethodUsed = "One-way SMS" }
            "TwoWayVoiceMobile" { $MethodUsed = "Phone call verification" }
            "PhoneAppOTP" { $MethodUsed = "Hardware token or authenticator app" }
            "PhoneAppNotification" { $MethodUsed = "Authenticator app" }
        }
    }
    Else {
        $MFAEnforced = "Disabled"
        $MethodUsed = "MFA Not Used"
    }

    $ReportLine = [PSCustomObject] @{
        "User Email"   = $User.UserPrincipalName
        "User Name"    = $User.DisplayName
        "MFA Status"   = $MFAEnforced
        "MFA Method"   = $MethodUsed
        "Phone Number" = $MFAPhone
    }

    $Report.Add($ReportLine)

    If ($MFAEnforced -eq "Disabled") {
        $NotMFAUser.Add($ReportLine)
    }

    If (($MFAEnforced -ne "Disabled") -and ($MethodUsed -eq "MFA Not Used")) {
        $MFANotUsed.Add($ReportLine)
    }

}

# The users MFA status
$Users.Count
$Report | Select "User Email", "User Name", "MFA Status", "MFA Method", "Phone Number" | Sort Name | Out-GridView
# Export the users MFA status
$Report | Sort Name | Export-CSV -NoTypeInformation -Encoding UTF8 C:\Tmp\MFAUsers.csv

# Show the users with MFA disabled
$NotMFAUser.Count
$NotMFAUser | Format-Table

# Show the users with MFA enabled but never setup
$MFANotUsed.Count
$MFANotUsed | Format-Table

# Register PSGallery
Register-PackageSource -ErrorAction SilentlyContinue -Name PSGallery -ProviderName PowerShellGet -Trusted

# See https://learn.microsoft.com/en-us/powershell/microsoftgraph/overview?view=graph-powershell-1.0
# See https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.reports/new-mgreportauthenticationmethoduserregistrationdetail?view=graph-powershell-1.0
# Install the Microsoft Graph PowerShell module
Install-Module Microsoft.Graph -Scope AllUsers
Connect-MgGraph -Scopes "User.Read.All", "Group.Read.All", "UserAuthenticationMethod.Read.All", "AuditLog.Read.All"
# Login with the Microsoft 365 Admin Account.

# IsMfaCapable = Indicates whether the user has registered a strong authentication method for multifactor authentication.
#                The method must be allowed by the authentication methods policy.
# IsMfaRegistered = Indicates whether the user has registered a strong authentication method for multifactor authentication.
#                   The method may not necessarily be allowed by the authentication methods policy.
$Users = Get-MgReportAuthenticationMethodUserRegistrationDetail -All | ? { $_.UserType -ne "Guest" }
$Report = foreach ($User in $Users) {
    [pscustomobject]@{
        UserDisplayName                              = $User.UserDisplayName
        UserPrincipalName                            = $User.UserPrincipalName
        IsMfaCapable                                 = $User.IsMfaCapable
        IsMfaRegistered                              = $User.IsMfaRegistered
        MethodsRegistered                            = $User.MethodsRegistered -join ', '
    }
}

$Report | Out-GridView -Title "MFA Status"
$Report | Export-CSV -NoTypeInformation -Encoding UTF8 C:\Tmp\MFAStatus.csv

# Login with the admin user account.
Connect-MsOlService

# Still need to test
Reset-MsolStrongAuthenticationMethodByUpn -UserPrincipalName <user>@<domain>
exit