MFA & Passwordless Coverage

The question it answers: Which accounts cannot perform multifactor authentication, and which administrators are among them?

Which accounts can actually perform multifactor authentication, and which administrators cannot. Source: Microsoft Graph reports/authenticationMethods/userRegistrationDetails. Disabled accounts are not returned by this endpoint, so they never appear below.

Note

Disabled accounts are never returned by this endpoint, so they cannot appear in the counts below.

At a glance

Where in the app	Entra ID › Security › MFA & Passwordless Coverage
Workload	Entra ID
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Entra ID P1 (authentication methods registration details).
Report id (API and MCP)	entra.security.mfa-coverage

Columns

Column	Key	Type
Display Name	DisplayName	Link
User Principal Name	UserPrincipalName	Text
Status	CoverageState	Status
Admin	IsAdmin	YesNo
MFA capable	IsMfaCapable	YesNo
SSPR registered	IsSsprRegistered	YesNo
Methods	MethodsRegisteredString	Text
User type	UserType	Text

Filters

Filter	Key (API)	On when the page opens
Show only accounts that cannot do MFA	gaps	No
Show only administrators	admins	No
Show only members who are not administrators	members	No

What it needs

Licence: Microsoft Entra ID P1 (authentication methods registration details).

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
AuditLog.Read.All	Microsoft Graph	Read all audit log data

Data sources it reads

• GET /v1.0/reports/authenticationMethods/userRegistrationDetails

Through the API and MCP

GET /ir-api/v1/reports/entra.security.mfa-coverage?size=100
GET /ir-api/v1/reports/entra.security.mfa-coverage?filter=gaps

An AI assistant reads it with the MCP tool get_report and the id entra.security.mfa-coverage. The client needs the Read grant for Entra ID. See Using the API.