Most Microsoft 365 admins enable MFA and move on, assuming the job is done. But as users join, leave, and move between roles, things change. Accounts get excluded from policies, service accounts are created, and temporary exceptions sometimes become permanent. That’s why it’s worth taking the time to audit your MFA coverage every now and then. In this article, we’ll walk through several ways to find users who don’t have MFA enabled in Microsoft Entra ID.
Why You Should Identify Users Without MFA
MFA is one of the most effective ways to protect Microsoft 365 accounts from unauthorized access. While most organizations understand its importance, many still have users who are not protected by MFA due to legacy configurations, temporary exceptions, or incomplete onboarding processes.
Regularly reviewing MFA coverage helps administrators:
- Identify accounts that don’t have MFA configured before they become security risks.
- Reduce the likelihood of account compromise by eliminating password-only authentication.
- Prepare for security audits and compliance assessments with accurate reporting.
- Remove outdated exceptions that were created for troubleshooting or temporary access.
Performing periodic MFA audits ensures your Microsoft 365 environment remains aligned with modern security best practices.
Check Which Users Don’t Have MFA Enabled in Microsoft
To find users with disabled Multi-Factor Authentication in Microsoft 365, you can use either the Microsoft Entra admin center or run a PowerShell script using the Microsoft Graph API.
Method 1: Using Microsoft Entra Admin Center (Per-User MFA)
Here’s the best way to check which users don’t have MFA enabled using Microsoft Entra admin center.
- Sign in to the Microsoft Entra admin center.
- Navigate to Entra ID → Users → All users.
- Then click on More options (…) and select Per-user MFA.
- On the redirected Multi-Factor Authentication page, use the View and Status filters to find users marked as Disabled.
Microsoft 365 provides powerful security capabilities, but determining exactly who is protected by MFA isn’t always straightforward.
There isn’t a single location within the Microsoft 365 admin experience that clearly shows which users are currently protected and which are not. Instead, administrators often need to collect information from several different portals.
Method 2: Using Microsoft Graph PowerShell
If you have a large organization, checking manually can take too long. You can use the modern MS Graph PowerShell to scan all user accounts who is missing MFA registration.
Connect to Microsoft Graph PowerShell module and run the following commands.
Get-MgReportAuthenticationMethodUserRegistrationDetail -All |
Where-Object { $_.IsMfaCapable -eq $false } |
Select-Object UserPrincipalName, DisplayName, IsMfaCapable |
Export-Csv -Path "$home\Desktop\MFA_Disabled_Users.csv" -NoTypeInformation You can also check registered authentication methods per user by running the below command.
Get-MgUser -All -Property Id, DisplayName, UserPrincipalName | ForEach-Object {
$User = $_
$Methods = Get-MgUserAuthenticationMethod -UserId $User.Id
[PSCustomObject]@{
User = $User.DisplayName
Email = $User.UserPrincipalName
MFA_Count = $Methods.Count
}
}Best Practices After Identifying Users Without MFA
After generating your list of users without registered MFA methods, consider taking the following actions:
- Contact affected users and ask them to complete MFA registration.
- Remove outdated exemption accounts that no longer require special access.
- Review Conditional Access policies to ensure MFA is enforced consistently.
- Disable or secure inactive accounts that aren’t protected.
- Schedule regular MFA audits to identify new gaps as your environment changes.
Enabling MFA is only the beginning. Periodically checking for users without MFA helps close security gaps, reduce the risk of account compromise, and keep your Microsoft 365 environment secure.
