Authentication Methods Policy Audit

The question it answers: Which sign-in methods does the tenant allow, for whom, and is the passkey registration campaign running?

Which sign-in methods the tenant allows, for whom, and whether the passkey registration campaign is running. This is the policy that decides whether users can register a phishing-resistant method at all.

Note

Group targets are resolved to names from the cached groups; an unresolved id is shown as-is.

At a glance

Where in the app	Entra ID › Security › Auth Methods Policy
Workload	Entra ID
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	No extra licence needed.
Report id (API and MCP)	entra.security.auth-methods-policy

Columns

Column	Key	Type
Method	MethodName	Text
State	State	Status
Assessment	Severity	Status
Recommendation	Recommendation	Text
Targets	IncludeTargets	Text
Excluded	ExcludeTargets	Text
Settings	Settings	Text

What it needs

Licence: No extra licence needed.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Policy.Read.All	Microsoft Graph	Read your organization’s policies

Data sources it reads

• GET /v1.0/policies/authenticationMethodsPolicy

Through the API and MCP

GET /ir-api/v1/reports/entra.security.auth-methods-policy?size=100

An AI assistant reads it with the MCP tool get_report and the id entra.security.auth-methods-policy. The client needs the Read grant for Entra ID. See Using the API.