diff --git a/src/Export-MsIdAzureMfaReport.ps1 b/src/Export-MsIdAzureMfaReport.ps1 index c2e32b3..d29b1b7 100644 --- a/src/Export-MsIdAzureMfaReport.ps1 +++ b/src/Export-MsIdAzureMfaReport.ps1 @@ -21,6 +21,11 @@ ![Screenshot of a sample Azure MFA report](../assets/export-msidazuremfareport-sample.png) * This report will assist you in assessing the impact of the [Microsoft will require MFA for all Azure users](https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/microsoft-will-require-mfa-for-all-azure-users/ba-p/4140391) rollout on your tenant. + ### MFA Status + + - **✅ MFA Capable + Signed in with MFA**: The user has MFA authentication methods registered and has successfully signed in at least once to Azure using MFA. + - **✅ MFA Capable**: The user has MFA authentication methods registered but has always signed into Azure using single factor authentication. + - **❌ Not MFA Capable**: The user has not yet registered a multi-factor authentication method and has not signed into Azure using MFA. Note: This status may not be accurate if your tenant uses identity federation or a third-party multi-factor authentication provider. See [MFA Status when using identity federation](#mfa-status-when-using-identity-federation). .DESCRIPTION ### Consenting to permissions @@ -31,10 +36,6 @@ After the initial consent the `Export-MsIdAzureMfaReport` cmdlet can be run by any user with the Microsoft Entra **Global Reader** role. - ### Identity federation and third-party multi-factor authentication - - The `MFA status` in this report may not be accurate if you use identity federation or a third-party multi-factor authentication provider. See [MFA Status when using identity federation](#mfa-status-when-using-identity-federation). - ### PowerShell 7.0 This cmdlet requires [PowerShell 7.0](https://learn.microsoft.com/powershell/scripting/install/installing-powershell) or later. diff --git a/website/docs/assets/export-msidazuremfareport-sample.png b/website/docs/assets/export-msidazuremfareport-sample.png index a6e6c37..379855c 100644 Binary files a/website/docs/assets/export-msidazuremfareport-sample.png and b/website/docs/assets/export-msidazuremfareport-sample.png differ diff --git a/website/docs/commands/Export-MsIdAzureMfaReport.mdx b/website/docs/commands/Export-MsIdAzureMfaReport.mdx index 9c71525..91f7277 100644 --- a/website/docs/commands/Export-MsIdAzureMfaReport.mdx +++ b/website/docs/commands/Export-MsIdAzureMfaReport.mdx @@ -17,7 +17,9 @@ The report also includes each user's multi-factor authentication (MFA) registrat ```powershell Install-Module MsIdentityTools -Scope CurrentUser + Connect-MgGraph -Scopes Directory.Read.All, AuditLog.Read.All, UserAuthenticationMethod.Read.All + Export-MsIdAzureMfaReport .\report.xlsx ``` @@ -26,17 +28,25 @@ Export-MsIdAzureMfaReport .\report.xlsx - Required Microsoft Entra role: **Global Reader** - Required permission scopes: **Directory.Read.All**, **AuditLog.Read.All**, **UserAuthenticationMethod.Read.All** - -*This report will assist you in assessing the impact of the [Microsoft will require MFA for all Azure users](https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/microsoft-will-require-mfa-for-all-azure-users/ba-p/4140391) rollout on your tenant.* +### Output ![Screenshot of a sample Azure MFA report](../assets/export-msidazuremfareport-sample.png) +* This report will assist you in assessing the impact of the [Microsoft will require MFA for all Azure users](https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/microsoft-will-require-mfa-for-all-azure-users/ba-p/4140391) rollout on your tenant. +### MFA Status + +- **✅ MFA Capable + Signed in with MFA**: The user has MFA authentication methods registered and has successfully signed in at least once to Azure using MFA. +- **✅ MFA Capable**: The user has MFA authentication methods registered but has always signed into Azure using single factor authentication. +- **❌ Not MFA Capable**: The user has not yet registered a multi-factor authentication method and has not signed into Azure using MFA. +Note: This status may not be accurate if your tenant uses identity federation or a third-party multi-factor authentication provider. +See [MFA Status when using identity federation](#mfa-status-when-using-identity-federation). + ## SYNTAX ```powershell Export-MsIdAzureMfaReport [[-ExcelWorkbookPath] ] [-SignInsJsonPath ] [-PassThru] - [-Days ] [-Users ] [-UsersMfa ] [-UseAuthenticationMethodEndPoint] - [-ProgressAction ] [] + [-Days ] [-Users ] [-UseAuthenticationMethodEndPoint] [-ProgressAction ] + [] ``` ## DESCRIPTION @@ -49,11 +59,6 @@ Export-MsIdAzureMfaReport [[-ExcelWorkbookPath] ] [-SignInsJsonPath