Microsoft has been pushing organizations toward modern, phishing-resistant authentication methods for years, and for good reason. As part of this evolution, legacy methods like Security Questions are scheduled for retirement next year in Spring 2027.
In a perfect world, every user would seamlessly migrate to the Microsoft Authenticator app or a FIDO2 security key. However, Enterprise Identity management is rarely perfect. In many environments, there is a subset of users who simply cannot use a mobile phone for authentication due to accessibility reasons, strict compliance rules, or clean-room manufacturing environments. For these users, Security Questions have remained a necessary fallback.
As the retirement deadline approaches, IT Identity Security teams need to know exactly who is still relying on this legacy method. You can’t plan an exception or an alternative hardware token rollout if you don’t know the scope of the problem.
In this post, we’ll look at a PowerShell script designed to take a list of specific users and report on whether they have Security Questions registered as an authentication method.
The Goal: Targeted Visibility
While the Entra admin center provides broad authentication method metrics, tracking down a specific subset of edge-case users often requires a more targeted approach. This script leverages the Microsoft Graph PowerShell SDK to:
- Ingest a targeted list of users from a CSV file (e.g., an exception list exported from HR or your ticketing system).
- Loop through each user in the provided file.
- Check each user’s registered authentication methods to see if Security Questions are configured.
- Output a clean report that can be exported for review.
Prerequisites
To run this script, you will need:
- PowerShell 7+
- Microsoft Graph PowerShell SDK (specifically the
Microsoft.Graph.Identity.SignInsmodule). - An Input CSV: A file containing the User Principal Names (UPNs) or Object IDs of the users you want to audit.
- Permissions: An account with Authentication Policy Administrator, Global Reader, or Reports Reader roles, and the following Graph API scope:
UserAuthenticationMethod.Read.All
Under the Hood: Querying the Graph API
Instead of manually clicking through the Entra portal, the script handles the heavy lifting by automating the Graph API calls required to evaluate your targeted users in bulk.
Once connected to your tenant with the required scopes, the script imports your CSV file and iterates through each row. For each individual user, it pulls their registered authentication methods and specifically filters for the #microsoft.graph.securityQuestionAuthenticationMethod OData type.
It then compiles these findings into a structured custom object for each user—flagging whether the method is “Registered” or “Not Registered”—and cleanly exports the final dataset to a new CSV file.
Why This Matters Now
By isolating this data into a simple report, you can start making data-driven decisions about your IAM infrastructure. If a user is on your “No Mobile Device” exception list but hasn’t registered security questions, how are they currently authenticating? If they are registered, what is the migration path for them before Microsoft officially retires the method?
Having a programmatic way to generate this report allows you to run it monthly as you track your migration progress toward alternative solutions like OATH hardware tokens or FIDO2 keys. (Note: I plan to add direct Security Group targeting in a future update to make this even more seamless!)
You can find the complete PowerShell script ready for deployment over in my GitHub repository:
👉 View AuthMethods-SecurityQuestionsRegistration.ps1 on GitHub
If you have a similar edge case in your environment or ideas on how to improve the script, feel free to submit a pull request!