Is there a way to tell if user used MFA from Azure AD logs

user_13001907 0
Viewed 3262

Searching through MS documentation on Azure login logs information meanings and cannot find anything that matches what I am looking for.

I have a user who "successfully" logged into their account via OAuth2, "UserAuthenticationMethod": "1" (which should be password use) The account has MFA enabled, I want to confirm that the user is using MFA and it was not bypassed in anyway or confirm that this was a refresh login from a token but cannot find any definitive information in the logs.

If anyone could point me to some documentation or even third party guides at this point would be a life saver.

I apologize if this post is in the wrong area, first time posting.

office365 azure-active-directory
1 Answers

You can check the MFA result under Azure MFA reports. It may not include every detail but it will show all usage and bypass history. https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-reporting

MFA Result: More information on whether MFA was satisfied or denied:

If MFA was satisfied, this column provides more information about how MFA was satisfied.

Azure Multi-Factor Authentication completed in the cloud has expired due to the policies configured on tenant registration prompted satisfied by claim in the token satisfied by claim provided by external provider satisfied by strong authentication skipped as flow exercised was Windows broker logon flow skipped due to app password skipped due to location skipped due to registered device skipped due to remembered device successfully completed Redirected to external provider for multi-factor authentication

The sign-ins report will also answer:

Was the sign-in challenged with MFA? How did the user complete MFA? Why was the user unable to complete MFA? How many users are challenged for MFA? How many users are unable to complete the MFA challenge? What are the common MFA issues end users are running into?

user_95414480
Related