How to find users without MFA in Microsoft Entra ID

Before you start

Use an account with a role that can read the report: Reports Reader, Security Reader, Security Administrator or Global Reader. The tenant needs Microsoft Entra ID P1 or P2. The PowerShell example requests AuditLog.Read.All; your organisation may require administrator consent.

Know what the report covers. It leaves out disabled and recently deleted accounts, and Microsoft says it updates for most users within 36 hours, so a method registered today can take a day or more to appear. The examples read the report and export it; they do not change any account or policy.

Option 1

Find users without MFA with PowerShell

Install the modules once, then connect and export the accounts with no MFA method registered. The filter runs in Microsoft Graph, so only the accounts you need come back.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.Reports -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'AuditLog.Read.All' -NoWelcome
try {
    $filter = 'isMfaRegistered eq false'
    $details = Get-MgReportAuthenticationMethodUserRegistrationDetail -All -Filter $filter
    $report = @($details | Where-Object { $_.UserType -eq 'member' } |
        Sort-Object @{ Expression = 'IsAdmin'; Descending = $true }, UserDisplayName |
        Select-Object UserDisplayName,UserPrincipalName,IsAdmin,IsMfaCapable,LastUpdatedDateTime)
    if ($report.Count -eq 0) {
        Write-Output 'Every enabled member account has an MFA method registered.'
    } else {
        $report | Export-Csv -Path './users-without-mfa.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) enabled member accounts have no MFA method registered."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The script keeps member accounts and sorts administrators to the top: an administrator with no MFA method is the row to act on first. Remove the Where-Object line to include guests. LastUpdatedDateTime is when the report last refreshed for that account, not when the person registered.

Check a single account

Reconnect with Connect-MgGraph, then read 1 person's registration. The main export above disconnects when it finishes.

# Run while connected to Microsoft Graph. Replace the example account.
$filter = "userPrincipalName eq 'person@example.com'"
Get-MgReportAuthenticationMethodUserRegistrationDetail -Filter $filter |
    Select-Object UserDisplayName,IsMfaRegistered,IsMfaCapable,MethodsRegistered

IsMfaRegistered says a strong method is registered. IsMfaCapable says the method is also allowed by the tenant's authentication methods policy. An account that is registered and not capable has a method the policy no longer accepts.

Option 2

Review MFA registration in the admin centre

1. Sign in to the Microsoft Entra admin centre for the correct tenant.
2. Go to Entra ID > Authentication methods > Activity.
3. On the Registration tab, select Users capable of Azure multifactor authentication to open the list of user registration details.
4. Use the controls at the top of the list to search for a person or to filter a column, such as setting MFA Capable to Not Capable.
5. Read Methods registered for each account. Leave the page without changing anything.

This suits a quick look at a tenant you already have open. For a list you can keep, sort and compare month to month, export it with PowerShell or a report.

Common questions

Does a registered method mean MFA is enforced?

No. Registration says a method exists. Whether a sign-in asks for it depends on Conditional Access policies or security defaults. Review both: a registered account that no policy covers is never asked, and an account with no method is asked to register the next time a policy requires MFA.

Why is a disabled account missing from the list?

The report lists enabled accounts only, and recently deleted accounts are left out too. To see which of the remaining accounts still hold licences, see how to export licensed users.

Why does the report return an error or nothing at all?

Check the licence and the role first. The report needs Microsoft Entra ID P1 or P2, and the signed-in account needs 1 of the reader roles above along with consent for AuditLog.Read.All.