Skip to main content

Get if a user has MFA available in Entra ID

  • June 25, 2025
  • 8 replies
  • 30 views

MikelSA
Forum|alt.badge.img+8

Hi, i made an azure query, but i cant get if the user has MFA activated or no?

I saw Graph function "GET MFA Status" But it requires some permissions that I dont have.

Is there any chance to get MFA details for a user? I want to implement that in my playbook, and see if a user has MFA activated or not?

Thanks.

8 replies

mikewilusz
Staff
Forum|alt.badge.img+10
  • Staff
  • June 25, 2025

< DELETED >


ylandovskyy
Staff
Forum|alt.badge.img+16
  • Staff
  • June 26, 2025

< DELETED >


@mikewilusz ,

I think your answer was meant for this post: https://www.googlecloudcommunity.com/gc/SecOps-SOAR/Playbook-failure-watcher/td-p/921137/jump-to/first-unread-message.

@Simon_King_79 FYI.

In terms of the original question, @MikelSA , our Enrich User action should allow you to get this information, but let me check and get back to you. It's just weird that Azure requires a separate dedicated request just for this.


MikelSA
Forum|alt.badge.img+8
  • Author
  • Bronze 2
  • June 26, 2025

@mikewilusz ,

I think your answer was meant for this post: https://www.googlecloudcommunity.com/gc/SecOps-SOAR/Playbook-failure-watcher/td-p/921137/jump-to/first-unread-message.

@Simon_King_79 FYI.

In terms of the original question, @MikelSA , our Enrich User action should allow you to get this information, but let me check and get back to you. It's just weird that Azure requires a separate dedicated request just for this.


Perfect, thank you.


ylandovskyy
Staff
Forum|alt.badge.img+16
  • Staff
  • June 27, 2025

Perfect, thank you.


@MikelSA ,

Looks like you are right, there is a different dedicated method to return information about MFA. Our current integration doesn't support it, so you would need to open a FR request for it.


MikelSA
Forum|alt.badge.img+8
  • Author
  • Bronze 2
  • June 27, 2025

@MikelSA ,

Looks like you are right, there is a different dedicated method to return information about MFA. Our current integration doesn't support it, so you would need to open a FR request for it.


Okai, thank you very much


MikelSA
Forum|alt.badge.img+8
  • Author
  • Bronze 2
  • June 27, 2025

@MikelSA ,

Looks like you are right, there is a different dedicated method to return information about MFA. Our current integration doesn't support it, so you would need to open a FR request for it.


With the action "Get user MFA" on graph integration, would it possible?


ylandovskyy
Staff
Forum|alt.badge.img+16
  • Staff
  • June 27, 2025

With the action "Get user MFA" on graph integration, would it possible?


@MikelSA ,

From my quick research:

https://graph.microsoft.com/beta/users/$($User.Id)/authentication/requirements

Should return this information.


MikelSA
Forum|alt.badge.img+8
  • Author
  • Bronze 2
  • June 27, 2025

@MikelSA ,

From my quick research:

https://graph.microsoft.com/beta/users/$($User.Id)/authentication/requirements

Should return this information.


Okai, thanks a lot.