Governance 807

Get-EntraMfaRegistrationGapReport

Reports every user who has not registered any multi factor authentication method, so the gap in MFA coverage is a concrete list rather than an assumption.

Get-EntraMfaRegistrationGapReport.ps1

<#
.SYNOPSIS
    Finds users with no MFA method registered.

.DESCRIPTION
    Pulls the authentication method registration report and lists every
    enabled user with zero registered MFA methods, turning the gap in
    MFA coverage into a concrete, actionable list.

.EXAMPLE
    .\Get-EntraMfaRegistrationGapReport.ps1

.NOTES
    Requires Microsoft.Graph.Reports with an active Connect-MgGraph
    session and Reports.Read.All scope.

.AUTHOR
    Shehryar Hassan
#>

$details = Get-MgReportAuthenticationMethodUserRegistrationDetail -All

$noMfa = $details | Where-Object { -not $_.IsMfaRegistered -and $_.UserType -eq "Member" } |
    Select-Object UserPrincipalName, IsMfaRegistered, IsAdmin

$noMfa | Sort-Object IsAdmin -Descending | Format-Table -AutoSize
Write-Warning "$($noMfa.Count) user(s) with no MFA method registered, including $((($noMfa | Where-Object IsAdmin).Count)) admin account(s)."

Read it before you run it, and test in a safe tenant first.