{"id":854,"date":"2026-09-17T11:55:11","date_gmt":"2026-09-17T10:55:11","guid":{"rendered":"https:\/\/www.server1.dk\/?p=854"},"modified":"2026-09-17T11:59:42","modified_gmt":"2026-09-17T10:59:42","slug":"kql-to-detect-if-you-users-still-use-text-sms-for-mfa","status":"publish","type":"post","link":"https:\/\/www.server1.dk\/?p=854","title":{"rendered":"KQL to detect if you users still use Text\/SMS for MFA on Azure\/M365"},"content":{"rendered":"\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">SigninLogs\n| mv-expand AuthenticationDetails = parse_json(AuthenticationDetails)\n| where TimeGenerated > ago(120d)\n| where AuthenticationDetails.authenticationMethod == \"Text message\"\n| project  UserPrincipalName, AuthenticationDetails.authenticationMethod, AuthenticationDetails.authenticationMethodDetail\n| summarize count()by UserPrincipalName<\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/www.server1.dk\/wp-content\/uploads\/2026\/09\/image.png\"><img loading=\"lazy\" decoding=\"async\" width=\"274\" height=\"140\" src=\"https:\/\/www.server1.dk\/wp-content\/uploads\/2026\/09\/image.png\" alt=\"\" class=\"wp-image-856\"\/><\/a><\/figure>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-854","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.server1.dk\/index.php?rest_route=\/wp\/v2\/posts\/854","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.server1.dk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.server1.dk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.server1.dk\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.server1.dk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=854"}],"version-history":[{"count":3,"href":"https:\/\/www.server1.dk\/index.php?rest_route=\/wp\/v2\/posts\/854\/revisions"}],"predecessor-version":[{"id":858,"href":"https:\/\/www.server1.dk\/index.php?rest_route=\/wp\/v2\/posts\/854\/revisions\/858"}],"wp:attachment":[{"href":"https:\/\/www.server1.dk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=854"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.server1.dk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=854"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.server1.dk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=854"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}