Auditing Microsoft Authenticator Registrations in Entra ID with PowerShell

As organizations shift toward modern, phishing-resistant multi-factor authentication (MFA) like the Microsoft Authenticator app with number matching, tracking adoption rates across the user base becomes a critical administrative task. While the Microsoft Entra admin center offers built-in authentication methods reporting, there are times when you need a targeted, automated, and easily exportable report for a specific security group.

Whether you’re rolling out a new Conditional Access policy that mandates the Microsoft Authenticator app or just cleaning up legacy MFA methods, knowing who has registered (and who hasn’t) is vital.

In this post, we’ll look at a PowerShell script designed to target a specific Entra ID security group, query user authentication methods via the Microsoft Graph PowerShell SDK, and generate a clear status report on Microsoft Authenticator app registrations.

The Challenge: Group-Targeted Visibility

By default, Entra ID reporting dashboards provide a broad organizational view of authentication method registrations. However, administrators often face scenarios like:

• Staged Rollouts: You are enforcing Authenticator app usage for a pilot group (e.g., “Finance-MFA-Pilot”) before a company-wide mandate.
• Compliance Audits: You need to pull a compliance snapshot exclusively for high-privilege groups or specific department security groups.

Using the Microsoft Graph API and PowerShell, we can bridge this gap by programmatically isolating group membership and drilling down into individual authentication methods.

Prerequisites

Before running the script, ensure you have the following in place:

1. PowerShell 7+ (recommended for modern scripting practices).
2. Microsoft Graph PowerShell SDK installed (Microsoft.Graph.Authentication, Microsoft.Graph.Groups, Microsoft.Graph.Identity.SignIns).
3. Permissions: The account executing the script must have permissions to read group membership and user authentication methods. Typically, this requires roles like Authentication Policy Administrator, Global Reader, or Reports Reader, along with Graph API permissions such as:
   • GroupMember.Read.All
   • UserAuthenticationMethod.Read.All

How the Script Works

The script operates through a straightforward multi-step pipeline:

1. Authentication: Connects to Microsoft Graph with the necessary scopes.
2. Group Resolution: Resolves the specified security group name or ID to fetch its direct (and optionally nested) members.
3. Method Enumeration: Loops through each member and queries the Entra ID Authentication Methods endpoint (/users/{id}/authenticationMethods).
4. Analysis & Reporting: Checks if a microsoftAuthenticatorAuthenticationMethod resource exists for the user, compiling details like device name, registration date, and overall status into a clean report object.

Code Highlight: Fetching Methods via Graph

At the core of the script is the ability to query the Microsoft Graph authentication methods. Instead of relying on legacy cmdlets, we leverage modern Graph commands to inspect the state of the Authenticator app:

# Example concept snippet of querying user auth methods
Import-Module Microsoft.Graph.Identity.SignIns

# Connect with required scopes
Connect-MgGraph -Scopes "UserAuthenticationMethod.Read.All", "GroupMember.Read.All"

# Get members of a specific security group
$GroupId = "your-security-group-object-id"
$GroupMembers = Get-MgGroupMember -GroupId $GroupId -All

foreach ($member in $GroupMembers) {
    # Fetch authentication methods for the user
    $authMethods = Get-MgUserAuthenticationMethod -UserId $member.Id
    
    # Filter for Microsoft Authenticator app
    $authenticatorApp = $authMethods | Where-Object { $_.AdditionalProperties['@odata.type'] -eq '#microsoft.graph.microsoftAuthenticatorAuthenticationMethod' }
    
    if ($authenticatorApp) {
        # User has registered the app
        [PSCustomObject]@{
            UserPrincipalName = $member.AdditionalProperties['userPrincipalName']
            DisplayName       = $member.AdditionalProperties['displayName']
            Status            = "Registered"
            DeviceNames       = ($authenticatorApp.DisplayName -join ", ")
        }
    } else {
        # User has not registered the app
        [PSCustomObject]@{
            UserPrincipalName = $member.AdditionalProperties['userPrincipalName']
            DisplayName       = $member.AdditionalProperties['displayName']
            Status            = "Not Registered"
            DeviceNames       = $null
        }
    }
}

Output and Reporting

Once the script processes the group members, it outputs a clean, structured object that can easily be exported to a CSV file (Export-Csv) for stakeholders, project managers, or ticketing systems. This allows you to immediately identify laggards who may require targeted communication or assistance setting up their MFA app.

Wrapping Up

Automating these visibility checks saves hours of manual checking in the Entra portal and provides a repeatable process for identity governance.

You can find the complete, production-ready script, detailed installation instructions, and configuration options over in my GitHub repository:

👉 View the Script & README on GitHub

Have questions, feature requests, or improvements? Feel free to open an issue or pull request on the repo!