To track authentication-method registration details in Microsoft Entra ID, call Microsoft Graph’s v1.0 user registration details report: use the collection endpoint for a tenant-wide inventory, or append a user’s Entra object ID for one record. The report shows registration and capability state; it is not a real-time log of each registration change.
Choose the collection report or a single-user lookup
Both operations use the userRegistrationDetails report in Microsoft Graph v1.0. Use the collection endpoint to inventory users and apply supported filters; use the individual endpoint when you already have the user’s Entra object ID.
As an Amazon Associate I earn from qualifying purchases.
| Task | Request | What to know |
|---|---|---|
| List registration details | GET https://graph.microsoft.com/v1.0/reports/authenticationMethods/userRegistrationDetails |
Supports selected OData filters. Handle collection paging when processing results. |
| Get one user’s details | GET https://graph.microsoft.com/v1.0/reports/authenticationMethods/userRegistrationDetails/{userId} |
Replace {userId} with the user’s Entra object ID. This operation does not support OData query parameters. |
See Microsoft’s list operation reference and get operation reference for the current request and response details.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Get permission and access in place
For both operations, Microsoft documents AuditLog.Read.All as the least-privileged permission for application access and delegated work or school account access. For delegated access, the signed-in user also needs an appropriate Entra role or custom role. Microsoft lists Reports Reader, Security Reader, Security Administrator, and Global Reader for these v1.0 operations. Personal Microsoft accounts are not supported.
#1 Best Overall
Microsoft states that access to authentication methods usage and insights reports requires Microsoft Entra ID P1 or P2. Check that the tenant has the required licensing before deploying a report-based workflow. See the authentication methods usage and insights overview.
Make the Graph request
Acquire an access token for Microsoft Graph with the appropriate permission granted, then send it as a bearer token. For example, the raw HTTP request for a tenant-wide inventory is:
GET https://graph.microsoft.com/v1.0/reports/authenticationMethods/userRegistrationDetails
Authorization: Bearer {access-token}For one user, use the same authorization header and append the object ID to the path:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteGET https://graph.microsoft.com/v1.0/reports/authenticationMethods/userRegistrationDetails/{userId}
Authorization: Bearer {access-token}In the single-user request, {userId} is notation for the actual object ID, not text to send literally.
Filter a tenant-wide report
The collection endpoint supports filters on documented fields including isMfaCapable, isMfaRegistered, isSsprEnabled, isSsprRegistered, methodsRegistered, userDisplayName, and userPrincipalName. For example, request users whose report marks MFA as registered with:
GET https://graph.microsoft.com/v1.0/reports/authenticationMethods/userRegistrationDetails?$filter=isMfaRegistered%20eq%20trueTo select users whose registered methods include email, the documented collection syntax is:
GET https://graph.microsoft.com/v1.0/reports/authenticationMethods/userRegistrationDetails?$filter=methodsRegistered/any(x:x%20eq%20'email')URL-encode spaces and other characters as needed by your HTTP client. Supported operators vary by property, so verify the exact expression against Microsoft’s list endpoint reference before relying on a more complex filter. Filtering is available on the collection operation, not the user-ID lookup.
Interpret registration and capability separately
A userRegistrationDetails record contains identity properties such as id, userDisplayName, userPrincipalName, and userType, plus an admin indicator, MFA and self-service password reset (SSPR) registration and capability indicators, passwordless capability, registered methods, preferred-method information, and lastUpdatedDateTime. The resource reference documents the fields and current method values.
Do not treat “registered” and “capable” as interchangeable. For example, isMfaRegistered indicates registration, while isMfaCapable reflects whether an allowed method is available under the authentication methods policy. A user may have a registered method that policy does not permit, so a registration count alone does not tell you whether the user can satisfy MFA under current policy.
methodsRegistered can include values such as mobilePhone, email, and passKeyDeviceBound. The set can evolve; consult Microsoft’s resource reference rather than assuming those examples are exhaustive.
Understand freshness and missing users
lastUpdatedDateTime is the UTC time the report record was last updated. It is not the timestamp of a specific registration action and should not be used as an event-level audit trail. Microsoft’s activity report guidance says details data updates within 36 hours for most users, with rare cases taking longer. For operational decisions, treat the endpoint as a periodically updated report rather than a real-time feed. See Microsoft’s authentication methods activity guidance.
Disabled users and recently deleted (soft-deleted) users are not listed in the report. The list operation explicitly does not work for disabled users, so absence from the result is not proof that an account never registered a method.
Use the current v1.0 API, not the retired report
For production integrations, use /reports/authenticationMethods/userRegistrationDetails. The older credentialUserRegistrationDetails API is deprecated; Microsoft’s documentation says it stopped returning data on June 30, 2024 and directs users to the newer user registration details API.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
