Microsoft 365 MFA Audit
An MFA coverage report for a tenant without the licence that makes it easy.
PJL needed to know who had multi-factor authentication. The aggregated registration report requires an Entra ID P1 licence the tenant does not have, so this script derives the answer from primitives available on any tenant.
A single PowerShell script using only the Graph authentication module and raw Graph requests. For each user it reads the authentication methods collection and counts only Authenticator, phone, FIDO2, software OATH, Windows Hello and temporary access passes as satisfying MFA at sign-in. It then reads the legacy per-user state for comparison and writes a CSV. Written and run in an afternoon; it found eleven of twelve staff covered and named the one who was not.