Report on users with MFA Enabled

It is not approved Microsoft process to pre publish the 2fa web page for the user to fill out.  You will notice the apppassword tab is missing as when till enabled.  I have found if users prefill out this form there is a problem in the 2factor process.  I need to reset all users that pre filled out form.  The hole process of enable and auto enforce makes the 2 factor process very difficult to role out. The app password on the phone is the hardest for people to understand as well.  You have no idea how long it will take to use the new app password on the phone.  Also the tab for app passwords does not even look like a tab and is often over looked by end users.  The visibility into the whole process is a complete different experience form Duo, reports  what reports !   Microsoft = NO reports of value... with out PowerShell. 

dbetlow 

Very similar to what others have suggested, but puts an output "mfastatus.csv" CSV in C:\Temp

get-MsolUser -all | select DisplayName,UserPrincipalName,@{N="MFA Status"; E={ if( $_.StrongAuthenticationRequirements.State -ne $null){ $_.StrongAuthenticationRequirements.State} else { "Disabled"}}} | Export-CSV c:\temp\mfastatus.csv -noTypeInformation

Just in case someone needs it, if you are using conditional access and not enforcing MFA, here's something I used to get the data for those who registered for MFA.

$reportFile = "C:\temp\output.csv";
Set-Content $reportFile "First Name,Last Name,UPN,Office,MFA Methods";
$testUser = Get-MsolUser -All;
foreach ($userObj in $testUser) {
$mfaMethods = $userObj.StrongAuthenticationMethods | Select-Object -ExpandProperty MethodType;
if ($mfaMethods) {
Write-Host $userObj.UserPrincipalName" "$mfaMethods;
Add-Content $reportFile "$($userObj.FirstName),$($userObj.LastName),$($userObj.UserPrincipalName),$($userObj.Office),$($mfaMethods)";
}
else {
Write-Host $userObj.UserPrincipalName" NONE";
Add-Content $reportFile "$($userObj.FirstName),$($userObj.LastName),$($userObj.UserPrincipalName),$($userObj.Office),NONE";
}
}

You can try this Msolservice PowerShell query to get users MFA Status 

Get-MsolUser -all | select DisplayName,UserPrincipalName,@{N="MFA Status"; E={ if( $_.StrongAuthenticationRequirements.State -ne $null){ $_.StrongAuthenticationRequirements.State} else { "Disabled"}}}

dbetlow 

Hi,

Sorry for the late response.
From my understating you wanted to know who got it setup before you forcefully enable it.

If a user setups MFA the value of "StrongAuthenticationMethods" will not be null

This should help:
Get-MsolUser -all | Select-Object DisplayName,UserPrincipalName,@{N="MFA User Setup"; E={ if( $_.StrongAuthenticationMethods -ne $null){"Enabled"} else { "Disabled"}}},@{N="MFA Admin Enforced"; E={ if( $_.StrongAuthenticationRequirements.State -ne $null){ $_.StrongAuthenticationRequirements.State} else { "Disabled"}}}

Hi dbetlow,

I would suggest using Microsoft Graph for the reports and all other scripts if plausible.

#Install module
install-Module Microsoft.Graph.Reports

# Or with force if you already have previous version
install-Module Microsoft.Graph.Reports -force

# Connect to graph with Reports read rights
Connect-Graph -Scopes "reports.read.all"

# Select Beta profile (the command is available only in Beta api)
Select-MgProfile -Name "beta"

# Get MFA details from users
Get-MgReportCredentialUserRegistrationDetail

From here you can easily export them to Json or CSV if needed.

Hope this helps,