Forum Discussion
Report on MFA Status with Conditional Access
The way I have resolved this is by creating a Dynamic Azure AD Group that adds all users eligible for MFA via Conditional Access (e.g. having the correct license assigned).
Then scoped the Conditional Access policy to that group.
Then, for the inventory, I have Powershell script using MsGraph that will chcek to see if any Authentication Method exists for all users and what method it is.
In the same script, I cross-reference these users with the Azure AD Group membership for the group that's scoped for Conditional License).
If user has an Authentication Method configured and is member of the group, MFA is enabled and enforced.
If user has an Authentication Method configured and not a member of the group, MFA is not enforced.
If user does not have an Authentication Method configured but is a member of the group, MFA is enabled but not yet enforced (e.g. user didn't enroll yet).
If user is not a member of the group, MFA is disabled.
Now this all sounds too much. And it is.
It's unbelievable that we have to do all of this to be able to report on such a basic feature.
But I really didn't see any other way to have a reliable inventory in our environment for MFA.
I would share the script, but it's really fully customized for our own environment and it wouldn't be usefull for you.
It does a complete inventory of all users, guests, licenses, last login, mfa, etc...
But as I've said... it's specific to our environment and it would be useless to share it with anyone.
The MFA part is loosely based on this script:
https://github.com/admindroid-community/powershell-scripts/blob/master/Export%20MFA%20Status%20Report%20using%20MS%20Graph/GetMFAStatusReport.ps1
I took snippets of that script because it's very well written.
But if you use it as is, and add a few lines to get AAD Group membership, you would have the same.