MFAMap audits authentication method registration across an Entra ID group, or every user in your tenant, and generates a self-contained HTML report. No app registration. No infrastructure. One script.
MFAMap runs under your existing account using delegated Graph API permissions. Nothing to register, nothing to configure in Entra before you start.
Run the script. It calls Connect-MgGraph and opens a standard Microsoft sign-in. No app registration, no service principal, no client secret to manage.
Choose one of five audit modes. Point it at a group with -GroupId, or audit every enabled member user in the tenant with -AllUsers. MFAMap queries each user's registered authentication methods via the Graph API.
A self-contained HTML file is saved to disk. Open it in any browser, attach it to a ticket, or drop it in SharePoint. No internet required to render it.
Each mode targets a specific MFA question. Pick one or run all five against the same group, or the whole tenant.
Any combination of Authenticator push, TOTP, or Windows Hello for Business.
Running a broad modern MFA baseline check across all users.
Whether the user has completed WHfB provisioning on any device.
Environments enforcing WHfB as the primary phishing-resistant credential.
Whether Authenticator is registered, push or TOTP, regardless of other methods.
Checking Authenticator rollout progress before enforcing it in Conditional Access.
FIDO2 security key or Authenticator device-bound passkey registration.
Tracking passkey rollout ahead of phishing-resistant authentication policies.
Every registered method per user: Authenticator, WHfB, FIDO2, Software OATH, SMS, Voice, Email OTP.
Full visibility across the tenant, or identifying users with no methods or legacy-only methods.
Re-run against the same group, or the whole tenant, and MFAMap detects the previous report automatically. The new output includes a change summary showing who enrolled, who lost a method, and the net movement. No database required.
All styles and interactivity are inlined into a single file. Open it offline, email it, or store it in SharePoint. No internet connection required to render it.
Runs entirely under your own delegated permissions. No Entra app to register, no client secret to rotate, and no service principal to maintain.
One .ps1 file. Install the Graph module once. No installer, no config file, no scheduled task. Nothing to uninstall when you're done.
Run with -AllUsers to audit every enabled member user in the tenant instead of a single group. No group size limit, no nested-group blind spots. Guests are left out, since their MFA lives in their home tenant.
The full method audit shows who has only SMS, only voice or no modern method at all, so you can see who'd be locked out before you turn a legacy method off. Export the list as a CSV ready for an Entra group import.
Per-user rows, per-method columns, status badges, and a coverage summary, all in a single HTML file.
Download the script from GitHub, install the Graph module once, and you're ready to go.
View on GitHub