Microsoft Entra ID

How to Check for Users with Weak MFA Methods in Microsoft 365

Multifactor Authentication (MFA) plays a critical role in protecting user identities in Microsoft 365. However, not all MFA methods offer the same level of security, as methods like SMS and voice calls remain vulnerable to phishing and SIM-swapping attacks. Thus, organizations should identify weaker authentication methods and enforce stronger, phishing-resistant methods to users. This guide helps to identify users with weak MFA methods and strengthen your organization’s authentication posture.

Find Users with Weak MFA Methods Using Microsoft Entra Admin Center

Microsoft 365 Permission Required:

Reports Reader Least Privilege

Global Admin Most Privilege

Log in to the Microsoft Entra admin center.
Navigate to Entra ID » Authentication methods » Monitoring » User registration details.
In the Methods registered filter, select weak MFA methods such as Mobile phone, Alternate mobile phone, Email, OATH hardware token, Temporary Access Pass (TAP), and Security questions, then click Apply.
The report displays all users who have registered at least one of the selected weak MFA methods.

Find Users with Weak MFA Methods Using Microsoft Entra Admin Center

Identify Users with Weak MFA Methods in Microsoft 365 Using PowerShell

Microsoft 365 Permission Required:

Reports Reader Least Privilege

Global Admin Most Privilege

Connect to the Microsoft Graph PowerShell module using the following cmdlet.

Windows PowerShell

 Connect-MgGraph -Scopes "UserAuthenticationMethod.Read.All"

Run the following cmdlet to list all Microsoft 365 users registered with weak MFA methods.

Windows PowerShell

 Get-MgReportAuthenticationMethodUserRegistrationDetail |Where-Object { 
$_.IsMfaRegistered -eq $true -and 
$_.MethodsRegistered"mobilePhone|alternateMobilePhone|officePhone|email|softwar
eOath|temporaryAccessPass" } | Select-Object UserPrincipalName, MethodsRegistered

This cmdlet lists all users with weak MFA methods, along with details such as user principal name, display name, and all registered authentication methods.

Identify Users with Weak MFA Methods in Microsoft 365 Using PowerShell

Simple & Quick
Export Users with Weak MFA Methods Using AdminDroid

AdminDroid Permission Required Delegated

Any user with report access delegated by the Super Admin.

Log in to AdminDroid 365 Portal
Navigate to the Users Registered with Weak Authentication Methods report under Reports » Entra » Insights » MFA Reports » Users with Weak MFA.
This report lists all Microsoft 365 users with weak MFA methods, along with details like display name, default and registered MFA methods, device names, authentication type, sign in status, and more.
You can also export the report in PDF, PDF+, CSV, or other preferred formats using the Download icon on the report.

Export Users with Weak MFA Methods Using AdminDroid

AdminDroid Entra ID MFA Reporting

Identify and Eliminate Weak MFA Gaps to Strengthen Microsoft 365 Security

AdminDroid’s Microsoft Entra ID reporting tool provides instant visibility into all users’ authentication methods. It highlights users with weak MFA, no MFA, passwordless authentication, or third-party authentication and helps admins find security gaps that often go unnoticed. With these insights, organizations can close security loopholes and strengthen their Microsoft 365 security posture.

Identify MFA-Disabled Users to Reduce Unauthorized Access Risks

Find all users without MFA setup in Microsoft 365 to enforce modern advanced authentication policies and mitigate the risk of credential-based attacks.

Track MFA Challenge Failures to Detect Suspicious Sign-In Activity

Keep an eye on users failed to pass MFA challenges in Microsoft 365 to identify repeated MFA attempts and detect MFA fatigue attacks, where users are spammed with authentication requests.

Verify Multi-Factor Authentication Protection for Microsoft 365 Admin Accounts

Review MFA-registered admins to ensure all privileged accounts in M365 are protected with MFA and strong authentication methods, as admin accounts are often key targets for cyberattacks.

Analyze MFA Authentication Methods to Detect Weak Sign-In Practices

Review user sign-in trends by authentication method across Microsoft Entra ID to identify use of weak MFA methods and transition users to phishing resistant authentication methods.

Review Basic Authentication Sign-Ins in Entra ID to Reduce MFA Bypass Risks

Audit user sign-ins via basic authentication protocols to identify and phase out legacy authentication methods that do not support MFA, ensuring all users adopt modern, secure authentication methods.

Keep Track of User MFA Security Posture Through Scheduled Reports

Schedule the User MFA details report periodically to monitor MFA status, registered authentication methods, default authentication methods, and MFA activation status across all Microsoft 365 users.

In conclusion, AdminDroid’s Entra ID management tool helps you to pinpoint and remove weak multi-factor authentication methods in Microsoft 365. With detailed authentication insights and centralized management, you can enforce stronger MFA policies to improve security and reduce risks. Backed by reporting, auditing, and management capabilities, you can strengthen your defence against evolving threats with AdminDroid.

Explore a full range of reporting options

Download Live Demo

Important tips

Turn on the hidden MFA security features, such as number matching and additional context, to strengthen the push notification based authentication and defend against MFA fatigue attacks.

Configure system-preferred MFA in Microsoft 365 to automatically prompt users with their strongest registered authentication method and reduce usage of weaker MFA methods.

Set up Entra ID’s registration campaign to nudge users with weak multi-factor authentication methods toward Microsoft Authenticator during their sign-in.

Common Errors and Resolution Steps

The following are the possible errors and troubleshooting hints while tracking users with weak MFA methods in Microsoft 365.

Error The 'Remove-MgUserAuthenticationPhoneMethod' command was found in the module 'Microsoft.Graph.Identity.SignIns', but the module could not be loaded.

This error may occurs when the Microsoft.Graph.Identity.SignIns module is not loaded properly in the current PowerShell session.

Fix Import the Microsoft.Graph.Identity.SignIns module and rerun the cmdlet. If the issue persists, reinstall the module and try again.

Import-Module Microsoft.Graph.Identity.SignIns.

Error Get-MgBetaReportAuthenticationMethodUserRegistrationDetail_List: User is not in the allowed roles.

This error occurs when the signed-in user does not have the required Microsoft Entra ID role to access authentication method registration details.

Fix Assign the user a supported Microsoft Entra ID role such as Global Administrator, Privileged Authentication Administrator, or Reports Reader to access authentication method registration details.

Error Remove-MgUserAuthenticationPhoneMethod: The term 'Remove-MgUserAuthenticationPhoneMethod' is not recognized as a name of a cmdlet, function, script file, or executable program.

This error occurs when the required Microsoft Graph PowerShell SDK is missing, not imported, or outdated.

Fix Install and import the Microsoft.Graph PowerShell module by running the following cmdlets to make the cmdlet available in the current PowerShell session.

Install-Module Microsoft.Graph -Scope CurrentUser 
Import-Module Microsoft.Graph

Microsoft Entra ID

Frequently Asked Questions

Identify and Manage Accounts Using Weak MFA Methods to Improve Sign-in Security

How to remove phone-based authentication methods for users in Microsoft 365?

How to block users from setting weak or bad passwords in Microsoft 365?

How to reset MFA for Microsoft 365 users with weak authentication methods?

How to prevent weak MFA usage in Microsoft 365 using Conditional Access?

1. How to remove phone-based authentication methods for users in Microsoft 365?

AI-powered phishing and Adversary-in-the-Middle (AiTM) attacks have turned SMS and voice-call MFA into some of the weakest links in modern security. Organizations relying on these legacy, phone-based methods remain highly vulnerable to threats ranging from SIM swapping and MFA fatigue to real-time session hijacking. To harden your environment and enforce phishing-resistant security, it is critical to phase out these phone-based options.

Note: Before removing phone-based MFA methods, ensure users have stronger authentication methods already registered to avoid leaving accounts without MFA protection.

Remove phone-based authentication methods for Microsoft 365 users

Navigate to the All users page in Microsoft Entra admin center.
Select the desired user account and click Authentication methods.
Under Usable authentication methods, locate the phone-based authentication method and click the ellipsis (…).
Click Delete and select Yes in the confirmation prompt to remove the phone-based authentication method.

Tip: You can use the same method above to remove any authentication method registered for a user.

Remove phone-based authentication for multiple users in bulk using PowerShell

Manually removing phone-based authentication methods for each user using the Remove-MgUserAuthenticationPhoneMethod cmdlet can be time-consuming, especially in large organizations. To simplify the process, you can automate the cleanup using the PowerShell script below. This helps remove outdated mobile phone-based authentication methods across the tenant quickly and consistently.

Download script: ResetPhoneAuthentication.ps1

Create a CSV file with the UPNs of users whose phone-based MFA you want to remove, as shown in the sample format below.
Download and run the following PowerShell script as below to delete the phone authentication method for all users in the CSV input file.
```
.\ResetPhoneAuthentication.ps1 -CSVFilePath "<Path of CSV File>“
```

powershell-bulk-remove-phone-authentication-methods

Tip : Instead of supplying users through a CSV file, you can use parameters such as -AllUsers, -AdminsOnly, -GuestUsersOnly, -DisabledUsersOnly, or -LicensedUsersOnly to target specific groups of users for phone-based authentication method removal.

Simplify phone authentication method cleanup with AdminDroid's Microsoft 365 management tool

Leverage AdminDroid's powerful management actions to remove phone-based authentication methods and other weak methods for individual or multiple users in just a few clicks from a centralized console.

admindroid-remove-phone-authentication-method

2. How to block users from setting weak or bad passwords in Microsoft 365?

MFA adds a strong layer of protection, but it should not become an excuse for weak passwords like “Password123.” If attackers obtain a weak password through phishing or password spraying attacks, they can still launch MFA fatigue attacks and pressure users into approving sign-in requests. That’s why securing the first layer of authentication is just as important as enforcing MFA.

By blocking weak and commonly used passwords using Microsoft password protection policies, organizations can significantly reduce account compromise risks and strengthen overall identity security.

Enforce a custom banned password list to block weak passwords in Microsoft 365.

Go to the Password protection page in the Microsoft Entra admin center.
Set Enforce custom list to Yes to enable custom banned password in Entra ID. The terms are case-insensitive, 4–16 characters long, and recognize substitutions (e.g., “@” for “a”).
Then, change the password protection mode from Audit to Enforced to actively block users from setting weak or banned passwords.
Click Save to apply the custom banned password list in Microsoft 365.

You can also configure additional protection settings, such as Lockout threshold and Lockout duration in seconds, to reduce password spray and brute-force attack attempts against user accounts.

3. How to reset MFA for Microsoft 365 users with weak authentication methods?

Manually removing each weak MFA methods for users is not practical in large organizations. Instead, you can reset MFA for affected users, which removes all registered authentication methods and forces them to re-register their authentication method during the next sign-in.

This creates the perfect opportunity to move users away from vulnerable methods like SMS and guide them toward phishing-resistant authentication methods such as Microsoft Authenticator, FIDO2 security keys, and Windows Hello for Business.

Reset multi-factor authentication for Microsoft 365 users via Entra ID

Go to the Entra admin center and navigate to Users » All users.
Select the target user and click on Authentication methods in the left-hand menu.
Click Require re-register multifactor authentication and choose 'OK’ on the confirmation prompt to complete the MFA reset.

Reset MFA for users with weak authentication methods in bulk using PowerShell

Resetting MFA for all users manually through the portal can be time-consuming, as it requires going through each user’s properties individually. In this scenario, you can use a PowerShell script to reset MFA for all users who use a specific authentication method in your organization.

For example, download and run the script as follows to reset MFA for all users who have registered a phone number as their authentication method.

Download script: ResetMFAMethods.ps1

.\ResetMFAMethods.ps1 -AllUsers -ResetMFAMethod Phone

Note : You can reset other authentication methods by changing the value of the -ResetMFAMethod parameter. Supported values include Phone, Email, and TemporaryAccessPass.

4. How to prevent weak MFA usage in Microsoft 365 using Conditional Access?

Users often choose the most convenient MFA option during sign-in, which usually leads to widespread use of weak authentication methods in Microsoft 365. Instead of relying on user convenience, you can use Conditional Access authentication strengths to control which MFA methods are allowed for sign-ins.

This helps block insecure authentication methods and enforce stronger, phishing-resistant options across the organization.

Follow the steps below to restrict weak MFA methods using Conditional Access in Microsoft 365

Log in to the Microsoft Entra admin center.
Navigate to Entra ID » Conditional Access » Create new policy.
In the New policy pane, configure the required fields, such as Name, Assignments, Target resources, Access Control, and Conditions, based on your policy requirements.
Then go to Access controls » Grant, select Grant access, and choose the required authentication strengths.
From the dropdown, choose an authentication strength such as Passwordless MFA, Phishing resistant MFA, or Phishing-resistant Only strength based on your organization’s security and compliance requirements, then click Select.
Finally, set Enable policy to On and click Create.

This configuration reduces phishing risks by enforcing passwordless authentication and blocking weak MFA methods.

Important Note: Ensure users have at least one supported authentication method (such as Microsoft Authenticator, FIDO2 security key, or Windows Hello for Business) before enforcing this policy. Users without these methods will be blocked from signing in to the Microsoft 365 environment.