Identity · Entra MFA Readiness

AuthMethods Readiness Analyzer

Drop in a Microsoft Entra authentication-methods registration export and see where your tenant stands for the 2026–2027 MFA changes — phishing-resistant coverage, SMS/voice retirement exposure, passkey readiness, SSPR gaps and an admin risk worklist. Reads the export; never connects to your tenant.

Paste or drop a userRegistrationDetails export to begin · Client-side only — nothing leaves the browser

100% in-browser
How to produce the export (one Graph call) 
# PowerShell — Microsoft Graph module
Connect-MgGraph -Scopes "AuditLog.Read.All","Reports.Read.All"
Get-MgReportAuthenticationMethodUserRegistrationDetail -All |
  ConvertTo-Json -Depth 5 | Out-File authmethods.json -Encoding utf8

# …or the raw Graph endpoint
GET https://graph.microsoft.com/v1.0/reports/authenticationMethods/userRegistrationDetails

# …or Entra admin center → Authentication methods → User registration details → Download (CSV)

Nothing analysed yet. Drop an export above, paste one, or hit Load sample to see the analyzer with a demo tenant.

Frequently asked questions

What does the AuthMethods Readiness Analyzer do?

It reads a Microsoft Entra authentication-methods registration export and reports how ready your tenant is for the 2026–2027 MFA changes: phishing-resistant coverage, which users are exposed to the SMS/voice retirement, who is a passkey migration target, SSPR gaps, and which admins have the weakest methods. It produces worklists and exports you can act on.

Is my data uploaded anywhere?

No. The tool is 100% client-side — parsing and analysis run entirely in your browser using JavaScript. Your export never leaves your device, nothing is sent to a server, and no tenant connection or admin consent is required. You can even run it offline.

How do I get the export it needs?

Run one Microsoft Graph call. In PowerShell: Connect-MgGraph -Scopes "AuditLog.Read.All","Reports.Read.All" then Get-MgReportAuthenticationMethodUserRegistrationDetail -All | ConvertTo-Json -Depth 5 | Out-File authmethods.json. Or export the Authentication methods → User registration details report as CSV from the Entra admin center. Paste or drop the file here.

Why does the SMS/voice retirement matter?

From Feb 1 2027 Microsoft retires its provided telephony (SMS and voice) delivery for MFA, with no opt-out. Users whose only usable method is a phone will be prompted to register a stronger method and can be blocked at sign-in. The analyzer lists exactly that population so you can run a targeted campaign before the deadline.

What counts as phishing-resistant?

FIDO2 security keys, passkeys (device-bound, including in Microsoft Authenticator), Windows Hello for Business, and certificate-based authentication. Authenticator push and TOTP are strong but not phishing-resistant; SMS and voice are neither. Passkeys become the default sign-in experience from Sep 1 2026, which is why the tool flags a passkey migration list.

Which fields does it read?

From the v1.0 userRegistrationDetails schema: userPrincipalName, userDisplayName, userType, isAdmin, isMfaRegistered / isMfaCapable, isPasswordlessCapable, isSsprRegistered / isSsprCapable, methodsRegistered[], userPreferredMethodForSecondaryAuthentication and lastUpdatedDateTime. The beta endpoint adds defaultMfaMethod if you want richer preferred-method data.

Can I track progress over time?

Yes. Load an earlier export as a baseline and the tool shows the change in phishing-resistant coverage, SMS/voice exposure and passkey targets, plus which users moved up or down — so you can measure a migration campaign week over week.

TokenDecoder → JWT / SAML / OIDC token inspector KQL Builder → Sentinel & Defender XDR query builder WinEvents → Windows Event ID lookup with MITRE ATT&CK mappings