Get MFA authentication methods

adocasar — Tue, 14 Feb 2023 09:54:26 GMT

Hello community!

I was wondering if there's any integration that would allow me to get the defined authentication methods for a given user. The use case is to know if someone who has entered credentials in a phishing portal has MFA enabled or not and take actions in consequence.

I have been looking in Microsoft Graph User integration but there is no command for this although I'm sure the information could be gathered from there.

Regards!

Re: Get MFA authentication methods

cpayne26 — Tue, 25 Apr 2023 00:10:48 GMT

Perhaps look at The Graph API interface Based on https://learn.microsoft.com/en-us/graph/authenticationmethods-get-started You can test this request GET https://graph.microsoft.com/beta/users/<userid>/authentication/methods and test to see if this give s you the data you want in https://developer.microsoft.com/en-us/graph/graph-explorer

Got these results when I tried it in my lab using The Cortex XSOAR Azure App for authentication and setting scope to UserAuthenticationMethod.Read.All

!msgraph-api-request resource="/users/leeg@somedomain.onmicrosoft.com/authentication/methods" api_version=beta

|@odata.type|id|isUsable|methodUsabilityReason|phoneNumber|phoneType|smsSignInState| |—|---|—|---|—|---|—| | #microsoft.graph.phoneAuthenticationMethod | <string>-<string>-<string>-<string>-<string> | true | EnabledByPolicy | 867-5309 | mobile | notAllowedByPolicy | |

topic Re: Get MFA authentication methods in Cortex XSOAR Discussions

Get MFA authentication methods

Re: Get MFA authentication methods