Microsoft 365 | Why doesn't my Microsoft 365 Inspector show MFA registration status?

Overview 💥

Liongard’s Microsoft 365 Inspector retrieves MFA registration data using the Microsoft Graph API. If your inspector is not displaying MFA registration status—or is showing users as not registered for MFA even though MFA is enabled—the most common cause is that the tenant is still using Office 365 Legacy Per-User MFA.

Legacy Per-User MFA is an older mechanism that was configured in the Office 365 admin center. Microsoft has officially deprecated this model and replaced it with Azure AD MFA managed through Conditional Access policies or Security Defaults. More information about this can be found here.

The Microsoft Graph API does not expose Legacy MFA settings, which means Liongard (and any Graph-based tooling) cannot detect or report MFA status when Legacy Per-User MFA is being used.

As a result:

Users protected by Legacy Per-User MFA will not show correct MFA registration data.
The Inspector may report those users as not having MFA registered or enabled.
MFA enforcement and registration information will only be available when MFA is enforced through Azure AD mechanisms (Conditional Access or Security Defaults).

Why This Happens 🤔

1️⃣ Legacy Per-User MFA is not accessible via Microsoft Graph

Legacy Per-User MFA:

Pre-dates Azure AD MFA enforcement mechanisms.
Was originally managed through the Office 365 admin center ("multi-factor authentication" page).
Stores MFA configuration in endpoints that Microsoft Graph does not query.
Has been fully deprecated by Microsoft in favor of Azure AD Conditional Access.

Microsoft explicitly states that:

Legacy MFA settings are not available via Graph, only via legacy O365 endpoints.
Graph-based solutions cannot report this data, including Liongard, Entra Admin Center MFA APIs, and other monitoring tools.

Therefore:

Liongard cannot pull registration status for users still using the legacy model.
Users appear unregistered / no methods configured.

2️⃣ Azure AD MFA Requires Conditional Access or Security Defaults

To surface MFA registration and enforcement data through Microsoft Graph, the tenant must be using one of the following:

✅ Conditional Access Policies

Supports granular enforcement based on user, group, application, network location, device platform, or sign-in risk.
Enables MFA requirement during sign-in under specific conditions.
Requires Azure AD Premium P1 license.
Exposes MFA registration and method data in Graph’s authenticationMethods API.

✅ Security Defaults

A baseline security configuration available at no extra cost.
Enforces MFA for all users.
Does not support granular targeting; applies to entire tenant.
Also surfaces MFA registration data in Microsoft Graph.

Without one of these mechanisms enabled, Graph cannot provide MFA-related information.

3️⃣ Licensing Requirements

To retrieve MFA details via Graph, users must meet the licensing requirement for the enforcement mechanism:

MFA Enforcement Model	Licensing Requirement	Graph API Support	Liongard MFA Reporting
Conditional Access	Azure AD Premium P1+	Fully Supported	Accurate
Security Defaults	No P1 required	Supported	Accurate
Legacy Per-User MFA	No license required	Not Supported	Not Accurate

If the tenant is only using Legacy Per-User MFA and has no Conditional Access policies and Security Defaults disabled, the Inspector cannot read MFA status.

Explanation of MFA Enforcement Models 🧑‍🏫

✅ Conditional Access Policies (Granular MFA Enforcement)

Conditional Access (CA) allows administrators to define rules such as:

Require MFA when signing in from outside the corporate network.
Require MFA for accessing privileged applications.
Require MFA for administrators, high-risk users, or service accounts.
Block access unless MFA is satisfied.

CA provides:

Fine-grained control.
Risk-based access policies.
Modern API visibility.
Full Graph reporting support.
The most accurate MFA configuration data for Liongard.

Because Conditional Access is the modern enforcement model, Microsoft Graph exposes:

Authentication methods registered (Authenticator app, SMS, FIDO2 keys).
Whether MFA is required.
Whether user registration is complete.

This is the model Microsoft recommends for all organizations using Azure AD.

✅ Security Defaults (Basic MFA Enforcement)

Security Defaults:

Forces MFA for all users by default.
Blocks older legacy protocols.
Enforces MFA during high-value operations (app registration, directory changes).
Does not require Azure AD Premium licensing.
Surfaces MFA information through Graph in a simplified model.

Security Defaults are ideal for:

Small organizations.
Tenants without security teams.
MSPs managing many small customers.

While Security Defaults lack the granularity of Conditional Access, they are fully compatible with Liongard’s MFA reporting.

Legacy Per-User MFA (Deprecated and Unsupported) 👀

Legacy Per-User MFA was a previous generation control with major limitations:

Enforced at the user level rather than through policies.
Managed through the old Office 365 admin portal.
Not connected to Microsoft Graph.
Does not expose authentication method or MFA registration status programmatically.
Officially deprecated by Microsoft.

Microsoft urges all organizations to migrate to Azure AD MFA through CA or Security Defaults.

Troubleshooting Checklist 👨‍💻

Use the following checklist to identify why MFA data may not be appearing:

➤ 1. Is the tenant using Legacy Per-User MFA?

If yes → MFA will not display in Liongard.
Check the Office 365 “Multi-factor authentication” page.
If the list shows “Enabled” or “Enforced” under Legacy MFA → this is the root cause.

➤ 2. Are Conditional Access policies configured to enforce MFA?

Verify:

At least one CA policy requires MFA.
Users in question are included in the policy scope.
The policy is not blocked, disabled, or overridden by exclusions.

➤ 3. Is Security Defaults enabled instead?

If Security Defaults is enabled:

Conditional Access is disabled automatically.
MFA enforcement is active tenant-wide.
MFA registration data should appear correctly.

➤ 4. Does the user have the required licenses?

This is critical:

Conditional Access MFA requires Azure AD Premium P1 or higher.
Security Defaults does not require P1, but CA does.

➤ 5. Is the Microsoft 365 Inspector running without errors?

Verify in Liongard:

No authentication failures.
No API permission errors.
No Graph throttling or 401/403 errors.

➤ 6. Has MFA registration actually been completed by the user?

Legacy MFA may allow users to authenticate without registering modern MFA methods (Authenticator app, phone, FIDO2 keys).
Azure AD MFA requires explicit method registration—visible in Graph.

➤ 7. Is the tenant recently migrated from Legacy MFA?

Migration notes:

It may take time for Graph to reflect accurate registration status.
Users may need to re-register MFA under the new model.

When to Contact Liongard Support 🦁

If:

Legacy Per-User MFA is disabled.
Conditional Access or Security Defaults is enabled.
Users meet licensing requirements.
The Inspector is running cleanly.

…and MFA registration status still appears incorrect, open a Liongard support case.

Please include:

Inspector name and URL.
Confirmation of CA/Security Defaults configuration (Screenshots).
Screenshot of Authentication Methods blade (Entra admin center).
Logs from a Clear Cache + Debug Mode run.

External Resource Disclaimer 🚨

This article references external Microsoft resources and tools. Liongard does not control availability, functionality, or accuracy of third-party sites. Use them as optional reference resources.