I did some tinkering. Try V1.3 of the script (now available from GitHub). There’s now a PrivacyFlag parameter. If set to False (the default), you get full details of MFA authentication methods. If true, you get the output as seen in V1.2.

There’s an API available to report authentication methods configured for accounts. I have a script that illustrates how to use the API in https://office365itpros.com/2022/10/07/authentication-methods-scripts/. It would be easy to take the code from that and insert it into the MFA report script to output authentication methods.

That permission was missing. Thank you, Tony!

Run Connect-MgGraph with the scopes stated in the script and it will ask you to consent for any permissions it doesn’t already have. If you are signed in with an admin account, you can grant consent.

Connect-MgGraph -NoWelcome -Scopes AuditLog.Read.All, Directory.Read.All, UserAuthenticationMethod.Read.All, Policy.ReadWrite.AuthenticationMethod

Reading the per-user MFA state requires consent to use the Policy.ReadWrite.AuthenticationMethod application permission. You don’t have the permission and that’s why you get a 403 Forbidden.

Hello Tony,
Could you please tell where to add this permission ?

The script executes with the following error at each user, and the report generates with no information in the ” Per user MFA state” column

Error is:
Invoke-MgGraphRequest : GET https://graph.microsoft.com/beta/users/831add8a-c129-47f7-860d-e7bc20425514/authentication/requirements
HTTP/1.1 403 Forbidden
Transfer-Encoding: chunked
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000
request-id: 7a19ba1b-582c-4459-9b0d-675a567c5237
client-request-id: b22995e8-ed97-4296-b100-b4a786b6ec2e
x-ms-ags-diagnostic: {“ServerInfo”:{“DataCenter”:”Poland Central”,”Slice”:”E”,”Ring”:”2″,”ScaleUnit”:”001″,”RoleInstance”:”WA2PEPF00000385″}}
Date: Sat, 15 Jun 2024 11:16:11 GMT
Content-Encoding: gzip
Content-Type: application/json
{“error”:{“code”:”accessDenied”,”message”:”Request Authorization failed”,”innerError”:{“message”:”Request Authorization failed”,”date”:”2024-06-15T11:16:11″,”request-id”:”7a19ba1b-582c-4459-9b0d-675a567c5
237″,”client-request-id”:”b22995e8-ed97-4296-b100-b4a786b6ec2e”}}}
At line:104 char:13
+ $Data = Invoke-MgGraphRequest -Uri $Uri -Method Get
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (Method: GET, Re…b4a786b6ec2e
}:HttpRequestMessage) [Invoke-MgGraphRequest], HttpResponseException
+ FullyQualifiedErrorId : InvokeGraphHttpResponseException,Microsoft.Graph.PowerShell.Authentication.Cmdlets.InvokeMgGraphRequest

Am I missing any permission?
Could you help me verify which one and where to grant it ?

Thank you very much!

403 Forbidden means that your session doesn’t have the right permission to execute the command, Do yuu have consent for Policy.ReadWrite.AuthenticationMethod?

I couldn’t use the “Update” method through partner permission, do you know why?

https://learn.microsoft.com/en-us/graph/api/authentication-update?view=graph-rest-beta&tabs=powershell#example-2-update-a-users-mfa-state

I receive this error bellow:

Invoke-WebRequest -Uri “https://graph.microsoft.com/beta/users/$($MgUser.Id)/authentication/requirements” -Headers $authHeader -Method Patch -Body $Body -UseBasicParsing

Invoke-WebRequest : The remote server returned an error: (403) Forbidden.
At line:22 char:13
+ $Response = Invoke-WebRequest -Uri “https://graph.microsoft.com/beta/ …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebException
+ FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand

There is only a https://graphpermissions.merill.net/permission/Policy.ReadWrite.AuthenticationMethod Policy.ReadWrite.AuthenticationMethod permission. There isn’t one restricted to read.

I wondered why the permissions structure was different for this operation, based inside the “Policy” domain rather than the existing “UserAuthenticationMethod” domain. Is Microsoft changing how these permissions are structured?

Thanks Vasil… I updated the text to show how to update the per-user MFA state for an account.

You can set it already, the endpoint supports PATCH requests as well (you’d need Policy.ReadWrite.AuthenticationMethod scope).

Now if they’ll just let me *set* the Per-User MFA Status through the API, I can shut down that Windows PowerShell kludge permanently.