Most Microsoft 365 admins enable MFA and move on, assuming the job is done. But as users join, leave, and move between roles, things change. Accounts get excluded from policies, service accounts are created, and temporary exceptions sometimes become permanent. That’s why it’s worth taking the time to audit your MFA coverage every now and then. In this article, we’ll walk through several ways to find users who don’t have MFA enabled in Microsoft Entra ID.
Why You Should Identify Users Without MFA
MFA is one of the most effective ways to protect Microsoft 365 accounts from unauthorized access. While most organizations understand its importance, many still have users who are not protected by MFA due to legacy configurations, temporary exceptions, or incomplete onboarding processes.
Regularly reviewing MFA coverage helps administrators:
- Identify accounts that don’t have MFA configured before they become security risks.
- Reduce the likelihood of account compromise by eliminating password-only authentication.
- Prepare for security audits and compliance assessments with accurate reporting.
- Remove outdated exceptions that were created for troubleshooting or temporary access.
Performing periodic MFA audits ensures your Microsoft 365 environment remains aligned with modern security best practices.
Check Which Users Don’t Have MFA Enabled in Microsoft
To find users with disabled Multi-Factor Authentication in Microsoft 365, you can use either the Microsoft Entra admin center or run a PowerShell script using the Microsoft Graph API.
Method 1: Using Microsoft Entra Admin Center (Per-User MFA)
Here’s the best way to check which users don’t have MFA enabled using Microsoft Entra admin center.
- Sign in to the Microsoft Entra admin center.
- Navigate to Entra ID → Users → All users.
- Then click on More options (…) and select Per-user MFA.
- On the redirected Multi-Factor Authentication page, use the View and Status filters to find users marked as Disabled.
Microsoft 365 provides powerful security capabilities, but determining exactly who is protected by MFA isn’t always straightforward.
There isn’t a single location within the Microsoft 365 admin experience that clearly shows which users are currently protected and which are not. Instead, administrators often need to collect information from several different portals.
Method 2: Using Microsoft Graph PowerShell
If you have a large organization, checking manually can take too long. You can use the modern MS Graph PowerShell to scan all user accounts who is missing MFA registration.
Connect to Microsoft Graph PowerShell module and run the following commands.
Get-MgReportAuthenticationMethodUserRegistrationDetail -All |
Where-Object { $_.IsMfaCapable -eq $false } |
Select-Object UserPrincipalName, DisplayName, IsMfaCapable |
Export-Csv -Path "$home\Desktop\MFA_Disabled_Users.csv" -NoTypeInformation You can also check registered authentication methods per user by running the below command.
Get-MgUser -All -Property Id, DisplayName, UserPrincipalName | ForEach-Object {
$User = $_
$Methods = Get-MgUserAuthenticationMethod -UserId $User.Id
[PSCustomObject]@{
User = $User.DisplayName
Email = $User.UserPrincipalName
MFA_Count = $Methods.Count
}
}PowerShell can generate a tenant-wide MFA report, but it requires the Microsoft Graph module, the necessary permissions, and familiarity with scripting. Administrators must also rerun the script and review the exported CSV whenever they need updated results.
EasyEntra simplifies this process with a reusable report that helps administrators quickly identify users who have not registered for MFA.
Method 3: Find Users Without MFA Registration Using EasyEntra
EasyEntra’s MFA Configuration and Readiness report helps identify users who have not registered for MFA or do not have a method capable of satisfying an MFA challenge.
To generate the report, do the following.
- Go to Entra ID, right-click Reports, and select New Report Template.
- Enter a report name and set Category to Security.
- Select MfaConfiguration as the report type.
- Configure the required scope by department, country, user type, or administrator status.
- Under MFA readiness, select Not MFA registered.
- Click Create, and then click Run.
The report displays each user’s MFA Registered, MFA Capable, Default MFA Method, Registered Methods, and overall MFA Readiness. This helps distinguish users who have not completed MFA registration from those who are registered but still require a stronger authentication method.
The report template can be reused for future audits. Administrators can also filter the results and click Export List… to export the affected users for follow-up.
Best Practices After Identifying Users Without MFA
After generating your list of users without registered MFA methods, consider taking the following actions:
- Contact affected users and ask them to complete MFA registration.
- Remove outdated exemption accounts that no longer require special access.
- Review Conditional Access policies to ensure MFA is enforced consistently.
- Disable or secure inactive accounts that aren’t protected.
- Schedule regular MFA audits to identify new gaps as your environment changes.
Enabling MFA is only the beginning. Periodically checking for users without MFA helps close security gaps, reduce the risk of account compromise, and keep your Microsoft 365 environment secure.
