Get-EntraAuthenticationMethodUserRegistrationDetailReport

The Get-EntraAuthenticationMethodUserRegistrationDetailReport cmdlet lists the user's registered authentication methods from the userRegistrationDetails object. This method doesn't work for disabled accounts (user accounts).

In delegated scenarios with work or school accounts, when acting on another user, the signed-in user must have a supported Microsoft Entra role or a custom role with the necessary permissions. The following least privileged roles support this operation:

• Reports Reader
• Security Reader
• Security Administrator
• Global Reader

Connect-Entra -Scopes 'AuditLog.Read.All'
Get-EntraAuthenticationMethodUserRegistrationDetailReport -All | Format-Table -AutoSize

Id                                   IsAdmin IsMfaCapable IsMfaRegistered IsPasswordlessCapable IsSsprCapable 
--                                   ------- ------------ --------------- --------------------- -------------
aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb True    False        False           False                 True      
bbbbbbbb-1111-2222-3333-cccccccccccc False   False        False           False                 False     
cccccccc-2222-3333-4444-dddddddddddd False   False        False           False                 False     
dddddddd-3333-4444-5555-eeeeeeeeeeee False   False        False           False                 False

This example demonstrates how to retrieve all the user's registered authentication methods.

Connect-Entra -Scopes 'AuditLog.Read.All'
Get-EntraAuthenticationMethodUserRegistrationDetailReport -UserRegistrationDetailsId 'aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb' | Format-Table -AutoSize

isMfaRegistered                               : False
@odata.context                                : https://graph.microsoft.com/v1.0/$metadata#reports/authenticationMethods/userRegistrationDetails(*)/$entity
userPrincipalName                             : [email protected]
isSystemPreferredAuthenticationMethodEnabled  : True
id                                            : aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb
isSsprRegistered                              : False
isSsprEnabled                                 : False
userDisplayName                               : Sawyer Miller
lastUpdatedDateTime                           : 3/16/2025 7:55:54 AM
userType                                      : member
isAdmin                                       : False
methodsRegistered                             : {}
systemPreferredAuthenticationMethods          : {}
userPreferredMethodForSecondaryAuthentication : none
isPasswordlessCapable                         : False
isSsprCapable                                 : False
isMfaCapable                                  : False

This example shows how to retrieve a specific user's registered authentication methods by UserRegistrationDetailsId.

• -UserRegistrationDetailsId parameter specifies the user's registered authentication methods.

Connect-Entra -Scopes 'AuditLog.Read.All'
Get-EntraAuthenticationMethodUserRegistrationDetailReport -Filter "userType eq 'member'" | Format-Table -AutoSize

Id                                   IsAdmin IsMfaCapable IsMfaRegistered IsPasswordlessCapable IsSsprCapable 
--                                   ------- ------------ --------------- --------------------- -------------
aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb True    False        False           False                 True      
bbbbbbbb-1111-2222-3333-cccccccccccc False   False        False           False                 False     
cccccccc-2222-3333-4444-dddddddddddd False   False        False           False                 False     
dddddddd-3333-4444-5555-eeeeeeeeeeee False   False        False           False                 False

This example demonstrates how to retrieve a user's registered authentication methods with filtering userType property.

Connect-Entra -Scopes 'AuditLog.Read.All'
Get-EntraAuthenticationMethodUserRegistrationDetailReport -Property id, userDisplayName, userType, isMfaRegistered, isPasswordlessCapable | Format-Table -AutoSize

Id                                   UserDisplayName   UserType IsMfaRegistered IsPasswordlessCapable
--                                   ---------------   -------- ---------------- ---------------------
cccccccc-2222-3333-4444-dddddddddddd Angel Brown       member   True             False
dddddddd-3333-4444-5555-eeeeeeeeeeee Alex Wilber       member   False            False
eeeeeeee-4444-5555-6666-ffffffffffff Avery Smith       member   False            False
bbbbbbbb-1111-2222-3333-cccccccccccc Christie Cline    member   False            False
aaaaaaaa-bbbb-cccc-1111-222222222222 Patti Fernandez   member   False            False

This example demonstrates how to retrieve a user's registered authentication methods. You can use -Select as an alias for -Property.

Connect-Entra -Scopes 'AuditLog.Read.All'
Get-EntraAuthenticationMethodUserRegistrationDetailReport -All -Sort 'lastUpdatedDateTime desc' -Limit 4 | Format-Table -AutoSize

Id                                   IsAdmin IsMfaCapable IsMfaRegistered IsPasswordlessCapable IsSsprCapable 
--                                   ------- ------------ --------------- --------------------- -------------
aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb True    False        False           False                 True

This example shows how to get one detail about the user's registered authentication methods. You can use -OrderBy or -SortBy as an alias for -Sort.

Connect-Entra -Scopes 'AuditLog.Read.All'
Get-EntraAuthenticationMethodUserRegistrationDetailReport -Top 1 | Format-Table -AutoSize

Id                                   IsAdmin IsMfaCapable IsMfaRegistered IsPasswordlessCapable IsSsprCapable 
--                                   ------- ------------ --------------- --------------------- -------------
aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb True    False        False           False                 True

This example shows how to get one detail about the user's registered authentication methods. You can use -Limit as an alias for -Top.

isAdmin (Boolean)

Shows whether the user has an admin role in the tenant. Use it to check which authentication methods privileged accounts register and use.

isMfaCapable (Boolean)

Indicates that the user uses a strong MFA method allowed by the authentication methods policy. Supports $filter (eq).

isMfaRegistered (Boolean)

Indicates whether the user registers a strong MFA method, even if the authentication methods policy doesn't allow it. Supports $filter (eq).

isPasswordlessCapable (Boolean)

Shows if the user registers a passwordless strong authentication method—like FIDO2, Windows Hello for Business, or Microsoft Authenticator—that the policy allows. Supports $filter (eq).

isSsprCapable (Boolean)

Shows if the user has registered enough methods and is allowed to use self-service password reset based on policy. Supports $filter (eq).

isSsprEnabled (Boolean)

Shows if the user is allowed to use self-service password reset by policy, even if they haven’t registered enough authentication methods. Supports $filter (eq).

isSsprRegistered (Boolean)

Shows if the user registers enough authentication methods for self-service password reset, even if the policy doesn't allow them to use it. Supports $filter (eq).

isSystemPreferredAuthenticationMethodEnabled (Boolean)

Shows if system-preferred authentication is on. When enabled, the system selects the most secure method from the ones the user registers. Supports $filter (eq).

lastUpdatedDateTime (DateTimeOffset)

The date and time (in UTC) when the report was last updated, in ISO 8601 format. For example, midnight UTC on Jan 1, 2014 is shown as 2014-01-01T00:00:00Z.

methodsRegistered (String collection)

List of registered authentication methods, like mobilePhone, email, or passKeyDeviceBound. Supports $filter with any and eq.

systemPreferredAuthenticationMethods (String collection)

List of the most secure second-factor authentication methods chosen by the system from the user's registered methods. Values include: push, oath, voiceMobile, voiceAlternateMobile, voiceOffice, sms, none. Supports $filter with any and eq.

userDisplayName (String)

The user's display name, like "Sawyer Miller." Supports $filter (eq, startsWith) and $orderby.

userPreferredMethodForSecondaryAuthentication (userDefaultAuthenticationMethod)

The user's chosen default method for second-factor authentication. Options include: push, oath, voiceMobile, voiceAlternateMobile, voiceOffice, sms, none. Used as the preferred MFA method when system-preferred authentication is off. Supports $filter with any and eq.

userPrincipalName (String)

The user's sign-in name, like [email protected]. Supports $filter (eq, startsWith) and $orderby.

userType (signInUserType)

Shows if the user is a member or guest in the tenant. Values: member, guest.

Get-EntraAuthMethodUserRegistrationDetailReport is an alias for Get-EntraAuthenticationMethodUserRegistrationDetailReport.