MFA

What it does Connects to Microsoft Graph and audits all enabled users in the tenant. For each user it checks registered authentication methods and identifies anyone with no MFA method registered — only the default password method. Results are exported to a timestamped CSV at C:\Temp\UsersWithoutMFA_YYYYMMDD_HHMMSS.csv. Useful for: Identifying MFA gaps before enforcing Conditional Access policies Periodic compliance audits on authentication posture Reporting to management on MFA adoption across the tenant Requirements Module: Microsoft.Graph ...

TL;DR September 1, 2026 — Passkeys become default. Users enabled for SMS/Voice are auto-enabled for passkeys and prompted to register. February 1, 2027 — Microsoft-provided SMS and Voice MFA fully retired. No opt-out. Users with no other MFA method will be blocked until they register a passkey. Action required now — Audit who in your tenant uses SMS/Voice and start migrating them to passkeys. 1. What Are Passkeys? Passkeys are phishing-resistant, passwordless credentials that replace both passwords and weak MFA methods like SMS OTP. Instead of a shared secret, they use a cryptographic key pair: ...