Get-EntraUserAuthenticationMethod

Get-EntraUserAuthenticationMethod

    -UserId <String>
    [<CommonParameters>]

The Get-EntraUserAuthenticationMethod cmdlet retrieves a list of a user's registered authentication methods. An authentication method is a way for a user to verify their identity, such as a password, phone (SMS or voice), or FIDO2 security key.

In delegated scenarios involving work or school accounts, where the signed-in user is acting on behalf of another user, the signed-in user must be assigned either a supported Microsoft Entra role or a custom role with the necessary permissions. For this operation, the following least privileged roles are supported:

• Global Reader
• Authentication Administrator
• Privileged Authentication Administrator

Connect-Entra -Scopes 'UserAuthenticationMethod.Read.All'
Get-EntraUserAuthenticationMethod -UserId 'SawyerM@Contoso.com' | Select-Object Id, DisplayName, AuthenticationMethodType

Id                                   DisplayName   AuthenticationMethodType
--                                   -----------   ------------------------
00001111-aaaa-2222-bbbb-3333cccc4444               #microsoft.graph.passwordAuthenticationMethod
11112222-bbbb-3333-cccc-4444dddd5555 iPhone 16     #microsoft.graph.microsoftAuthenticatorAuthenticationMethod

This example retrieves a Get a list of a user's registered authentication methods.

• -UserId parameter specifies the object ID of a user(as a UserPrincipalName or ObjectId).

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

The authentication administrator only sees masked phone numbers.