Phone Numbers Shared Across MFA Registrations

The question it answers: Which phone numbers are registered for MFA by more than one user, and does an admin share one?

When several accounts use the same phone number for MFA, whoever holds that phone - or takes it over with a SIM swap - can approve sign-ins for all of them. Shared numbers are usually a team phone, a manager’s mobile or a help-desk number; shared by an admin they are a real risk.

Note

Only users whose registration details list a phone method are read (the MFA registration cache must be loaded before you start the scan). SMS and voice are the weakest MFA methods - the long-term fix is the Authenticator app or passkeys.

At a glance

Where in the app	Entra ID › Identity Hygiene › Shared MFA Phone Numbers
Workload	Entra ID
Kind	Table · dashboard tile
Data	A scan: it runs only when someone presses Run scan (or calls the API’s scan action) and can take minutes. The last result is kept until the next scan.
Licence	Microsoft Entra ID P1 (registration details pick the users to scan).
Report id (API and MCP)	entra.security.shared-phone-numbers

Columns

Column	Key	Type
Number (masked)	MaskedNumber	Status
Users	Users	Text
Admins	Admins	Text
Who	UserList	Text
Registered as	PhoneTypes	Text

What it needs

Licence: Microsoft Entra ID P1 (registration details pick the users to scan).

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
UserAuthenticationMethod.Read.All	Microsoft Graph	Read all users’ authentication methods

Data sources it reads

• GET /v1.0/reports/authenticationMethods/userRegistrationDetails (who has a phone method)
• GET /v1.0/users/{id}/authentication/phoneMethods (per user)

Through the API and MCP

GET /ir-api/v1/reports/entra.security.shared-phone-numbers?size=100
POST /ir-api/v1/reports/entra.security.shared-phone-numbers/scan

An AI assistant reads it with the MCP tool get_report and the id entra.security.shared-phone-numbers. The client needs the Run scan grant for Entra ID. See Using the API.