How to check the authentication methods policy in Entra ID

Before you start

Use an account in the Global Reader or Authentication Policy Administrator role, the least privileged roles Microsoft lists for reading the policy. The PowerShell example requests Policy.Read.AuthenticationMethod; your organisation may require administrator consent.

Know what the policy decides. A method enabled for a group can be registered and used by its members for sign-in and, from the Migration in Progress state on, for password reset. Until migration is complete, Microsoft also respects the legacy MFA and password reset policies, so a method must be off in all of them to stop it. The examples read and export; they change nothing.

Option 1

Check the authentication methods policy with PowerShell

Install the modules once, then connect, read the policy and export 1 row per method. The script also prints the policy's migration state.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.Identity.SignIns -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'Policy.Read.AuthenticationMethod' -NoWelcome
try {
    $policy = Get-MgPolicyAuthenticationMethodPolicy
    Write-Output "Migration state: $($policy.PolicyMigrationState)"
    $report = @(foreach ($method in $policy.AuthenticationMethodConfigurations) {
        # includeTargets belongs to each method's own type, so it sits in AdditionalProperties.
        $targets = $method.AdditionalProperties['includeTargets']
        $included = @($targets | ForEach-Object { $_['id'] })
        [pscustomobject]@{
            Method   = $method.Id
            State    = $method.State
            Included = $included -join '; '
            Excluded = @($method.ExcludeTargets.Id) -join '; '
        }
    })
    if ($report.Count -eq 0) {
        Write-Output 'The policy lists no authentication methods.'
    } else {
        $report | Sort-Object State, Method |
            Export-Csv -Path './authentication-methods.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) methods exported."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The CSV lists the disabled methods first, then the enabled ones, each by Microsoft's ID, such as Fido2, MicrosoftAuthenticator, Sms or TemporaryAccessPass. all_users in Included means every user; the other values are group IDs. The migration state is preMigration, migrationInProgress or migrationComplete; only the last ignores the legacy policies.

Option 2

Review the authentication methods policy in the admin centre

1. Sign in to the Microsoft Entra admin centre as at least a Global Reader.
2. Go to Entra ID > Authentication methods > Policies.
3. Select a method to open it, then read whether it is enabled, the groups it includes and excludes, and its settings.
4. Close the method without saving. To read the migration state, select Manage migration, then close it without saving.

This suits a quick read of 1 tenant, and shows group names. Each method opens on its own, so for every method and its targets in 1 list to keep and compare, use PowerShell or a report.

Common questions

Does an enabled method mean people must use MFA?

No. The policy says which methods people may register and use. Whether a sign-in asks for MFA comes from Conditional Access or security defaults. To see who has registered a method, see how to find users without MFA.

Why can people use a method I turned off?

Microsoft respects every policy that still applies, so a person enabled for a method in any of them can register and use it. If the migration is not complete, check the legacy MFA and password reset settings too. For example, Mobile phone in the legacy password reset policy allows both voice calls and text messages.

Why does a method target single users?

Microsoft removed the option to target individual users. Users targeted before the change stay in the policy, and Microsoft recommends moving them into a group. A policy that names many groups can also fail to save once it passes 20 KB, so consolidate groups where you can.