Users with no MFA registered

Multifactor authentication asks for a second proof of identity on top of the password, so a stolen password alone does not open the account (Microsoft Learn: How Microsoft Entra multifactor authentication works). An account that has registered no MFA method cannot be asked for that second proof at all, whatever your policies say. Administrators with no registered method are the most exposed, because one compromised admin password reaches the whole tenant.

Microsoft exposes the registration state per user in the userRegistrationDetails report, including whether the user is registered for MFA and which methods they registered (Microsoft Learn: List userRegistrationDetails).

This script is read-only: it only reads the registration report and changes nothing in your tenant. It needs the AuditLog.Read.All permission, and the signed-in account must hold a supported role such as Reports Reader, Security Reader, Security Administrator or Global Reader. The report does not cover disabled users.

Connect-MgGraph -Scopes "AuditLog.Read.All" -NoWelcome

Get-MgReportAuthenticationMethodUserRegistrationDetail -All -Filter "isMfaRegistered eq false" |
  Select-Object UserPrincipalName, UserDisplayName, UserType, IsAdmin, MethodsRegistered |
  Sort-Object IsAdmin -Descending |
  Format-Table -AutoSize

Disconnect-MgGraph

Every row is an enabled user who has not registered any MFA method. Read the columns in this order:

• IsAdmin = True: a privileged account without MFA. Treat these first.
• UserType = guest: an external person. Their MFA may be handled by their home tenant, so check your cross-tenant access settings before chasing them.
• Service or shared accounts: sign-in accounts used by a mailbox or a process rarely register methods. Decide for each one whether it should sign in interactively at all.
• MethodsRegistered: may still list a method such as an email address or phone used only for password reset. That is not an MFA method the sign-in policy can use, so the user still needs to register one.

1. Contact the administrators on the list and have them register a method today.
2. Ask the remaining users to register a method at their next sign-in, and set a date.
3. Confirm a Conditional Access policy requires MFA for them, so registration is not left optional (see the Conditional Access views in your inventory).
4. Run the query again after the deadline and chase what is left.

ConfigCobra's Inventory includes a built-in risk view for users with no MFA registered, next to views such as users inactive 90 days and guests who never signed in. Every connected cloud is scanned automatically every day, findings are linked to the inventory objects they concern, and the list can be exported as CSV. ConfigCobra stays read-only and never changes your tenant.