SOLVED
Home

Get all users subscribed to the self-service password reset service

%3CLINGO-SUB%20id%3D%22lingo-sub-102363%22%20slang%3D%22en-US%22%3EGet%20all%20users%20subscribed%20to%20the%20self-service%20password%20reset%20service%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-102363%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20there%20a%20way%20to%20get%20the%20list%20of%20users%20already%20subscribed%20for%20the%20SSPR%20or%20the%20ones%26nbsp%3B%20that%20are%20still%20not%20joined%20to%20the%20service%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERegards.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-102363%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20AD%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EIdentity%20Management%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-294648%22%20slang%3D%22en-US%22%3ERe%3A%20Get%20all%20users%20subscribed%20to%20the%20self-service%20password%20reset%20service%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-294648%22%20slang%3D%22en-US%22%3E%3CP%3EThat%20indeed%20shows%20which%20users%20that%20have%20registered%20for%20MFA.%20But%20is%20this%20the%20same%20as%20SSPR%3F%20In%20any%20way%2C%20in%20the%20new%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fauthentication%2Fconcept-registration-mfa-sspr-converged%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3EConverged%20registration%20for%20SSPR%20and%20MFA%3C%2FA%3E%2C%20this%20might%20all%20be%20the%20same.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-207785%22%20slang%3D%22en-US%22%3ERe%3A%20Get%20all%20users%20subscribed%20to%20the%20self-service%20password%20reset%20service%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-207785%22%20slang%3D%22en-US%22%3E%3CP%3EYou%20can%20try%20below%20powershell%20script%20to%20get%20the%20SSPR%20registered%20users%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EGet-Msoluser%20-All%20%7C%20where%20%7B%24_.StrongAuthenticationUserDetails%20-ne%20%24null%7D%20%7C%20Export-CSV%20-path%20%3CPATH%20to%3D%22%22%20csv%3D%22%22%20file%3D%22%22%3E%3C%2FPATH%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-149746%22%20slang%3D%22en-US%22%3ERe%3A%20Get%20all%20users%20subscribed%20to%20the%20self-service%20password%20reset%20service%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-149746%22%20slang%3D%22en-US%22%3E%3CP%3EHi%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20would%20also%20like%20to%20know%20if%20you%20found%20a%20solution%20for%20this.%20I%20have%20a%20O365%20tenant%20with%201.5mil%2B%20users%20and%20need%20to%20list%20those%20who%20have%20not%20registered%20for%20SSPR.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks%20in%20advance%3C%2FP%3E%0A%3CP%3EJ%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-142602%22%20slang%3D%22en-US%22%3ERe%3A%20Get%20all%20users%20subscribed%20to%20the%20self-service%20password%20reset%20service%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-142602%22%20slang%3D%22en-US%22%3E%3CP%3EHave%20you%20found%20a%20way%20to%20do%20this%20yet%20or%20the%20names%20of%20the%20tools%3F%20I%20have%20the%20same%20issure%20with%20a%20client%20with%20more%20than%26nbsp%3B100%20000%20users.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-102532%22%20slang%3D%22en-US%22%3ERe%3A%20Get%20all%20users%20subscribed%20to%20the%20self-service%20password%20reset%20service%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-102532%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Vasil%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECould%20you%20share%20the%20names%20of%20the%20ones%20you%20know%2C%20just%20for%20reference.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-102528%22%20slang%3D%22en-US%22%3ERe%3A%20Get%20all%20users%20subscribed%20to%20the%20self-service%20password%20reset%20service%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-102528%22%20slang%3D%22en-US%22%3E%3CP%3EIf%20you%20really%20need%20that%20data%2C%20there%20are%203rd%20party%20products%2C%20just%20saying%20%3A)%3C%2Fimg%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-102492%22%20slang%3D%22en-US%22%3ERe%3A%20Get%20all%20users%20subscribed%20to%20the%20self-service%20password%20reset%20service%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-102492%22%20slang%3D%22en-US%22%3EYou%20are%20correct%2C%20I%20recently%20ran%20into%20this%20same%20issue%20with%20one%20of%20my%20clients.%3CBR%20%2F%3E%3CBR%20%2F%3EThis%20is%20just%20another%20example%20of%20needing%20to%20fully%20understand%20the%20capabilities%20and%20limitations%20of%20the%20tools%20while%20trying%20to%20keep%20up%20with%20the%20changes.%3CBR%20%2F%3E%3CBR%20%2F%3EI%20would%20not%20be%20surprised%20to%20see%20these%20limits%20increased%20in%20the%20future.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-102419%22%20slang%3D%22en-US%22%3ERe%3A%20Get%20all%20users%20subscribed%20to%20the%20self-service%20password%20reset%20service%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-102419%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%20Dean%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20looking%20for%20more%20historical%20data%2C%20not%20for%20the%20last%2030%20days%20that%20AAD%20reporting%20provides%2C%20but%20it%20seems%20the%20we%20are%20the%20ones%20that%20should%20have%20stared%20collecting%20the%20historical%20data%20at%20our%20side%2C%20since%20I%20have%20not%20found%20any%20other%20solution.%3C%2FP%3E%3CP%3E%22%3C%2FP%3E%3CP%3EReporting%20API%20data%20retrieval%20limitations%3C%2FP%3E%3CP%20class%3D%22lf-text-block%20lf-block%22%3ECurrently%2C%20the%20Azure%20AD%20Reports%20and%20Events%20API%20retrieves%20up%20to%20%3CSTRONG%3E75%2C000%20individual%20events%3C%2FSTRONG%3E%20of%20the%20%3CA%20href%3D%22https%3A%2F%2Fmsdn.microsoft.com%2Flibrary%2Fazure%2Fmt126081.aspx%23BKMK_SsprActivityEvent%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CFONT%20color%3D%22%230066cc%22%3ESsprActivityEvent%3C%2FFONT%3E%3C%2FA%3E%20and%20%3CA%20href%3D%22https%3A%2F%2Fmsdn.microsoft.com%2Flibrary%2Fazure%2Fmt126081.aspx%23BKMK_SsprRegistrationActivityEvent%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CFONT%20color%3D%22%230066cc%22%3ESsprRegistrationActivityEvent%3C%2FFONT%3E%3C%2FA%3E%20types%2C%20spanning%20the%20%3CSTRONG%3Elast%2030%20days%3C%2FSTRONG%3E.%3CSPAN%20class%3D%22lf-thread-btn%22%3E%3CA%20target%3D%22_blank%22%3E%2B%3C%2FA%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%20class%3D%22lf-text-block%20lf-block%22%3EIf%20you%20need%20to%20retrieve%20or%20store%20data%20beyond%20this%20window%2C%20we%20suggest%20persisting%20it%20in%20an%20external%20database%20and%20using%20the%20API%20to%20query%20the%20deltas%20that%20result.%20Our%20recommendation%20is%20to%20begin%20retrieving%20this%20data%20when%20you%20start%20using%20SSPR%20in%20your%20organization%2C%20persist%20it%20externally%2C%20and%20then%20continue%20to%20track%20the%20deltas%20from%20this%20point%20forward.%3C%2FP%3E%3CP%3E%22%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERegards.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-102374%22%20slang%3D%22en-US%22%3ERe%3A%20Get%20all%20users%20subscribed%20to%20the%20self-service%20password%20reset%20service%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-102374%22%20slang%3D%22en-US%22%3E%3CP%3EThere%20are%20many%20reports%20available%20for%20that%20type%20of%20info%2C%20see%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Factive-directory-passwords-reporting%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Factive-directory-passwords-reporting%3C%2FA%3E.%3CBR%20%2F%3E%3CBR%20%2F%3EThe%20SSPR%20Funnel%20in%20the%20Azure%20AD%20Content%20Pack%20for%20Power%20BI%20may%20also%20be%20helpful%2C%20see%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Factive-directory-reporting-power-bi-content-pack-how-to%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Factive-directory-reporting-power-bi-content-pack-how-to%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Carlos Gomez
Contributor

Hi,

 

Is there a way to get the list of users already subscribed for the SSPR or the ones  that are still not joined to the service?

 

Regards.

9 Replies

Thanks Dean,

 

I'm looking for more historical data, not for the last 30 days that AAD reporting provides, but it seems the we are the ones that should have stared collecting the historical data at our side, since I have not found any other solution.

"

Reporting API data retrieval limitations

Currently, the Azure AD Reports and Events API retrieves up to 75,000 individual events of the SsprActivityEvent and SsprRegistrationActivityEvent types, spanning the last 30 days.+

If you need to retrieve or store data beyond this window, we suggest persisting it in an external database and using the API to query the deltas that result. Our recommendation is to begin retrieving this data when you start using SSPR in your organization, persist it externally, and then continue to track the deltas from this point forward.

"

 

Regards.

Solution
You are correct, I recently ran into this same issue with one of my clients.

This is just another example of needing to fully understand the capabilities and limitations of the tools while trying to keep up with the changes.

I would not be surprised to see these limits increased in the future.

If you really need that data, there are 3rd party products, just saying :)

Hi Vasil,

 

Could you share the names of the ones you know, just for reference.

 

Thanks.

Have you found a way to do this yet or the names of the tools? I have the same issure with a client with more than 100 000 users.

Hi

 

I would also like to know if you found a solution for this. I have a O365 tenant with 1.5mil+ users and need to list those who have not registered for SSPR.

 

Thanks in advance

J

You can try below powershell script to get the SSPR registered users:

 

Get-Msoluser -All | where {$_.StrongAuthenticationUserDetails -ne $null} | Export-CSV -path <path to CSV file>

That indeed shows which users that have registered for MFA. But is this the same as SSPR? In any way, in the new Converged registration for SSPR and MFA, this might all be the same.

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
46 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
30 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies