> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/reports/mfa-report.md). # MFA Report The MFA Report gives you a consolidated view of MFA setup across a Microsoft tenant — whether that MFA is enforced through native Microsoft methods (Conditional Access, per-user MFA, Security Defaults) or through Duo. Partners typically use the MFA Report to: * Identify users who don't have MFA enforced at all. * Identify users who are enforced for MFA but aren't yet **Protected**, because enforcement hasn't caught up or they could still unregister themselves. * Identify weaker MFA methods, such as Phone/SMS, that Microsoft is deprecating. * Share ongoing MFA status with the tenant, via [Scheduled Reports](/reports/scheduled-reports.md). ## What the report shows Per employee, the MFA Report displays: | Field | Details | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | | Identity | Full name and email address | | License Type | The Microsoft license assigned to the user | | Role | The user's role | | MFA Configuration | Whether MFA is required, and through which method: Conditional Access, Per-User MFA (Microsoft legacy MFA), Security Defaults, or Duo + Conditional Access | | MFA Status | See below | | MFA Authentication Type | Authentication App, Phone/SMS, Security Key, or Other | ### MFA Status values | Status | Meaning | | --------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | | Protected | MFA is required, and the user has registered a method | | Not Protected | MFA is either not required, or the user hasn't registered a method | | Sign-in Blocked | The account can't be accessed at all — technically not MFA-compliant, but not a live risk either, since the account can't be signed into | ## Export and scheduling The MFA Report can be exported as PDF or CSV, or delivered automatically through [Scheduled Reports](/reports/scheduled-reports.md). {% hint style="warning" %} The MFA Report is currently a per-company (per-tenant) view. If you manage many customers and want a single report of MFA authentication methods across your entire book of business — for example, to find every user across every tenant still using Phone/SMS ahead of Microsoft's deprecation of that method — that rollup isn't available today. You'd need to compile it tenant by tenant, or submit it as a feature request via the Augmentt community. {% endhint %} ## Related MFA management The MFA Report tells you where things stand. To actively manage or remediate MFA: * Use **Security Postures** to enforce and monitor MFA-related checks at scale. * Use **Engage** to manage per-user MFA directly. ## A gotcha to know about Support has seen cases where a user with no usable MFA methods at all in Entra doesn't appear in the MFA Report, while other users with similar licensing do. The report's inclusion logic isn't a simple "does this user have zero authentication methods" check — it also accounts for factors like whether the user is in scope of a Conditional Access MFA policy, license eligibility, and recent sign-in activity. If a user you expect to see flagged is missing from the report, don't assume the report is wrong before checking whether that user is actually in scope of an MFA policy in Entra. {% hint style="warning" %} The exact inclusion/exclusion logic behind the MFA Report wasn't independently verifiable against the codebase in this session — treat the explanation above as directional, and confirm specific edge cases with Augmentt Support if the numbers look off for a tenant. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://helpdesk.augmentt.com/reports/mfa-report.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.