Notification or Alerts for MFA setting

Question

Hi Everyone

Could we setup an alert when a MFA method is added, changed or deleted in Microsoft account setting security option?

Answer 1

@Hafiz Shoaib

Currently, we do not have an option to configure an alert when any of the MFA methods is added, deleted or modified.

But you can pull the report on which user has registered for which MFA method.

You can get this report using Azure portal GUI.

• Login to Azure portal with global admin credentials.
• Go to Azure active directory.
• Click on Security
• Then click on Authentication Methods.
• Now you can click on "User registration details" and "Registration and reset events".
• This is the report that shows which user is registered for what authentication method in MFA.

Let me know if you have any questions on this.

If you are looking for an alert to be configured you can submit a feedback in Azure feedback portal regarding this.

https://feedback.azure.com/d365community/forum/22920db1-ad25-ec11-b6e6-000d3a4f0789

Let me know if you have any further questions.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

I had the same question and figured out how to create an Alert Rule in Azure for this. Azure charges you $.50/month for the Alert Rule plus your logs consumption for Entra ID.

Step 1: Go to Entra ID in Azure. Go to the Diagnostic Settings menu item and setup Logs for AuditLogs. We send ours to a Log Analytics workspace. This will record any instances of user MFA sessions.

Step 2: go to Alerts in Azure and create an Alert Rule. For Scope, point it to the Log Analytics Workspace where you are saving your Entra ID logs from step 1. For Condition, select "Custom log search". Set the query as:

AuditLogs
| where OperationName == 'User registered security info'

Measure: Table Rows Aggregation Type: Count Aggregation granularity: 6 hours Operator: Greater Than Threshold value: 0 Frequency: 6 hours For Action Groups, we set up an email notification to our admins.

Answer 3

Hi,

I suggest you post this issue to Microsoft 365 Admin Center:

https://techcommunity.microsoft.com/t5/microsoft-365-admin-center/bd-p/AdminCenter

The reason why we recommend posting appropriately is you will get the most qualified pool of respondents, and other partners who read the forums regularly can either share their knowledge or learn from your interaction with us. Thank you for your understanding.

---

If the response is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.