MFA‐Analyzer - LETHAL-FORENSICS/Microsoft-Analyzer-Suite GitHub Wiki

TL;DR

MFA-Analyzer.ps1 is a PowerShell script utilized to simplify the analysis of the MFA status of all users extracted via Microsoft-Extractor-Suite by Invictus-IR.

[!NOTE] *-MFA-AuthenticationMethods.csv and *-MFA-UserRegistrationDetails.csv must be in the same directory.

Fig 1: MFA-Analyzer (Microsoft 365 Developer Tenant)

Fig 2: Authentication Methods

Fig 3: User Registration Details

Fig 4: MFA-Status (Stats)

Fig 5: AuthenticationMethod (Stats)

Fig 6: MethodsRegistered (Stats)

Links

What authentication and verification methods are available in Microsoft Entra ID?
authenticationMethod resource type
userRegistrationDetails resource type