KQL to detect if you users still use Text/SMS for MFA on Azure/M365

Posted on by 
SigninLogs
| mv-expand AuthenticationDetails = parse_json(AuthenticationDetails)
| where TimeGenerated > ago(120d)
| where AuthenticationDetails.authenticationMethod == "Text message"
| project  UserPrincipalName, AuthenticationDetails.authenticationMethod, AuthenticationDetails.authenticationMethodDetail
| summarize count()by UserPrincipalName

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.