Entra ID¶

Get-UserMfaMethodReport.ps1¶

Synopsis: Reports every user's registered MFA/authentication methods and default method, flagging accounts that rely solely on SMS/Voice (red) or whose default method is SMS/Voice even though other methods exist (yellow).

Built ahead of the Microsoft Entra ID SMS/Voice retirement (https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement). Works on both Entra ID P1/P2 tenants and Free/Business Basic tenants:

On P1/P2 tenants it uses the fast tenant-wide report (Get-MgReportAuthenticationMethodUserRegistrationDetail), one call for every user, including the reported preferred/default method.
On tenants without P1/P2 (or if that report is unavailable/unlicensed) it falls back to the per-user authentication methods API (Get-MgUserAuthenticationMethod), which does not require premium licensing, and best-effort per-user sign-in preference for the default method.

The script never modifies anything in the tenant - it only reads authentication method registrations - so it does not need -WhatIf/-Confirm.

Row classification in the HTML/CSV output: - RED ("SmsVoiceOnly"): the only MFA-capable method(s) registered are SMS and/or Voice call. These accounts will hit the blocking passkey prompt on Feb 2027 retirement with no fallback. - RED ("SmsVoiceDefault"): the user's actual default/preferred method is SMS or Voice, even though other methods are also registered - the direct risk this retirement is about. - YELLOW ("SmsVoiceRegistered"): other MFA methods are registered too, and SMS or Voice is also registered (but not the default) - still needs to be removed ahead of the retirement. - (none): no SMS/Voice exposure, or no MFA registered at all (flagged separately in the Notes column - a different problem, not this retirement).

Intended to be run once per tenant. For an MSP/CSP audit across many customer tenants, call this script once per tenant (looping over your GDAP-delegated customers) and collect the per-tenant CSV outputs.

Parameters:

Parameter	Description
`TenantId`	Target Entra ID tenant ID or domain to connect to. Optional if you are already connected via Connect-MgGraph, or if you want the interactive/ device-code sign-in to resolve the tenant itself.
`OutputFolder`	Folder to write the CSV and HTML report to. Defaults to the current working directory.
`IncludeGuests`	Include guest (B2B) accounts in the report. By default only Member users are reported, matching how Microsoft scopes the SMS/Voice retirement.
`ForcePerUserLookup`	Skip the fast tenant-wide registration report even if the tenant has P1/P2, and use the slower per-user method lookup for every user instead. Useful for validating the two code paths against each other.

Examples:

PS> .\Get-UserMfaMethodReport.ps1
Connects interactively, reports on the current tenant, and writes
UserMfaMethodReport.csv / .html to the current folder.

PS> .\Get-UserMfaMethodReport.ps1 -TenantId "contoso.onmicrosoft.com" -OutputFolder "C:\Audits\Contoso"
Reports on a specific customer tenant (e.g. via GDAP) and writes output
to a per-client folder.

Notes

Author: Petr Štěpán Created: 2026-07-27 Version: 1.0.1 Changelog: 1.0.0 - Initial version 1.0.1 - Added tenant authentication methods policy overview (console summary and HTML report), progress bar for per-user processing, pre-flight Microsoft.Graph module version check with an offer to auto-repair mismatched/missing modules, and a new RED classification for accounts whose actual default sign-in method is SMS/Voice (previously only flagged yellow unless it was the user's only method).

Remove-InactiveEntraDevice.ps1¶

View in Gitea

Synopsis: Removes Entra ID devices and Intune managed devices that have not connected in longer than a given number of days.

Connects to Microsoft Graph, finds stale Entra ID and Intune-managed devices, and removes the matching device records after checking their last sign-in and last sync activity. It also reports devices that cannot be deleted, devices with no reliable activity signal, and whether an Autopilot registration still exists.

Parameters:

Parameter	Description
`InactiveDays`	Number of days of inactivity after which a device is considered stale. Defaults to 90.
`TenantId`	Optional tenant ID or verified domain name to sign in to. If omitted, Connect-MgGraph uses the interactive account picker / default tenant.

Examples:

.\Remove-InactiveEntraDevice.ps1 -WhatIf
Signs in, lists every Entra ID and Intune-only device inactive for more than 90
days, and shows what would be removed without changing anything.

.\Remove-InactiveEntraDevice.ps1 -InactiveDays 180 -TenantId 'contoso.onmicrosoft.com'
Signs in to the specified tenant and, after a single confirmation prompt,
removes every device that has not connected in more than 180 days.

.\Remove-InactiveEntraDevice.ps1 -Confirm:$false
Signs in and removes every inactive device without even the single upfront
confirmation prompt - use only for unattended/scheduled execution, ideally after
a prior -WhatIf run has already been reviewed.

Notes

Author: Petr Stepan Created: 2026-07-17 Version: 1.0.0 Changelog: 1.0.0 - Initial version

Remove-UserAuthenticationMethod.ps1¶

View in Gitea

Synopsis: Removes a chosen type of registered authentication method (phone, Microsoft Authenticator, FIDO2, etc.) from Entra ID users in bulk.

Connects to Microsoft Graph, lets the caller pick which authentication method type to remove (interactively from a menu, or via -MethodType for unattended runs), then removes every registered entry of that type for each in-scope user.

Safety: for MFA-capable method types, if the selected type is a user's only remaining MFA-capable method, removing it would leave them unable to complete MFA at all. This script never does that - such users are automatically skipped (never modified) and reported separately so an admin can register them another method first. Temporary Access Pass does not count as a substitute method for this check, since it is a one-time/short-lived bootstrap credential, not an ongoing MFA method. Email is not an MFA method at all (SSPR only), so removing it is never blocked by this check.

Parameters:

Parameter	Description
`TenantId`	Optional tenant ID or verified domain name to sign in to. If omitted, Connect-MgGraph uses the interactive account picker / default tenant.
`MethodType`	Which authentication method type to remove: Phone, MicrosoftAuthenticator, Fido2, WindowsHelloForBusiness, SoftwareOath, TemporaryAccessPass, PlatformCredential, or Email. Omit to choose from an interactive menu instead.
`UserPrincipalName`	Optional. Limit the run to these specific users instead of the whole tenant.
`IncludeGuests`	Include guest (B2B) accounts. By default only enabled Member users are processed.
`OutputFolder`	Folder to write the results CSV to. Defaults to the current working directory.

Examples:

.\Remove-UserAuthenticationMethod.ps1 -WhatIf
Signs in, prompts for which method type to remove, lists every enabled Member
user in the tenant, and shows what would be removed (and what would be skipped
to avoid leaving a user with no MFA method) without changing anything.

.\Remove-UserAuthenticationMethod.ps1 -MethodType Phone -TenantId 'contoso.onmicrosoft.com'
Signs in to the specified tenant and, after a single confirmation prompt, removes
every eligible user's phone authentication method(s).

.\Remove-UserAuthenticationMethod.ps1 -MethodType Phone -UserPrincipalName 'alice@contoso.com','bob@contoso.com' -Confirm:$false
Removes phone authentication methods for just the two named users, without even
the single upfront confirmation prompt - use only once a prior -WhatIf run against
the same scope has already been reviewed.

Notes

Author: Petr Stepan Created: 2026-07-29 Version: 1.1.0 Changelog: 1.0.0 - Initial version (phone/SMS-Voice authentication methods only) 1.1.0 - Generalized to any removable authentication method type, selected interactively from a menu or via the new -MethodType parameter