> For the complete documentation index, see [llms.txt](https://docs.realmjoin.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.realmjoin.com/automation/runbooks/runbook-references/user/security/list-mfa-methods.md).
# List Mfa Methods
List the MFA and authentication methods of this user
### Description
Shows every authentication method registered for this user in Entra ID, including the phone numbers of phone-based methods. Phone numbers can be masked to their last four digits. Optionally the user gets an email that an administrator has looked at their methods. Nothing is changed.
### Privacy and audit
This runbook reads sensitive identity data: the registered MFA methods of a user, including phone numbers. Phone numbers are masked by default. Set `MaskPhoneNumbers` to `false` only when the full numbers are required for legitimate support purposes; the action is logged together with the caller name.
### Activate user notification
This runbook can optionally send a notification email to the target user informing them that their MFA methods were retrieved by an administrator. To enable this, you need to activate user notification in the runbook customization.
The json configuration for this is as follows:
```json
"rjgit-user_security_list-mfa-methods": {
"parameters": {
"UserName": {
"Hide": true
},
"NotifyUser": {
"Default": true,
"Hide": true
},
"MaskPhoneNumbers": {
"Hide": true
},
"EmailFrom": {
"Hide": true
},
"ServiceDeskDisplayName": {
"Hide": true
},
"ServiceDeskEmail": {
"Hide": true
},
"ServiceDeskPhone": {
"Hide": true
},
"ServiceDeskPortalUrl": {
"Hide": true
},
"ServiceDeskTicketUrl": {
"Hide": true
},
"LanguageOverride": {
"Hide": true
},
"CallerName": {
"Hide": true
}
}
}
```
For more information on how to customize runbooks, please refer to the [Runbook Customization Guide](https://docs.realmjoin.com/automation/runbooks/runbook-customization).
### Setup regarding email sending
Sending a notification email is optional and only happens when `NotifyUser` is enabled. The sender address is taken from the `RJReport.EmailSender` tenant setting.
This runbook sends emails using the Microsoft Graph API. To send emails via Graph API, you need to configure an existing email address in the runbook customization.
See the [RealmJoin Report Settings documentation](https://docs.realmjoin.com/automation/runbooks/runbook-report-settings) for details on all available settings.
#### Email branding
The report email honors the optional `RJReport.Branding.*` tenant settings:
* **Header and footer image** – public HTTPS URLs, PNG/JPEG/GIF, max. 200 KB each
* **Footer link** – target of the footer image
* **Accent and text color** – 6-digit hex values, e.g. `#0052cc`
When these settings are not configured, the default RealmJoin graphics and colors are used. An image that cannot be downloaded or validated, or an invalid color value, never prevents the report email – the corresponding default is used instead.
Setup instructions and image requirements: [Email branding](https://docs.realmjoin.com/automation/runbooks/runbook-report-settings#email-branding-optional).
### Location
User → Security → List MFA Methods
**Full Runbook name**
rjgit-user\_security\_list-MFA-methods
### Details
| Property | Value |
| ---------------- | ---------------------------------------------------------------------------------------- |
| Version | 1.2.0 |
| Required modules | RealmJoin.RunbookHelper (>= 0.8.10)
Microsoft.Graph.Authentication (>= 2.41.2)
|
| Schedulable | no |
### Permissions
#### Application permissions
* **Type**: Microsoft Graph
* Mail.Send *(optional — feature: Email report)*
* *Sends the MFA-lookup notification mail to the user's mailbox via Send-RjReportEmail when notification is enabled*
* Organization.Read.All
* *Reads /organization to put the tenant name into the notification email*
* User.Read.All
* *Resolves the target user to get id, mail, accountEnabled and usageLocation*
* UserAuthenticationMethod.Read.All
* *Lists the user's registered MFA methods including phone numbers and FIDO2 details*
### Parameters
#### UserName
User principal name of the user the runbook acts on. Set by the portal from the selected user.
| Property | Value |
| ---------------- | -------------------------------------- |
| Required | true |
| Default Value | |
| Type | String |
| Hidden in portal | yes (preset via runbook customization) |
#### NotifyUser
Whether the user is emailed that their methods were looked up. Preset in the runbook customization.
| Property | Value |
| ---------------- | -------------------------------------- |
| Required | false |
| Default Value | False |
| Type | Boolean |
| Hidden in portal | yes (preset via runbook customization) |
#### MaskPhoneNumbers
Whether phone numbers are shown masked, with only the last four digits. Preset in the runbook customization.
| Property | Value |
| ---------------- | -------------------------------------- |
| Required | false |
| Default Value | False |
| Type | Boolean |
| Hidden in portal | yes (preset via runbook customization) |
#### EmailFrom
Sender address of the notification email. Taken from the tenant setting RJReport.EmailSender.
| Property | Value |
| ---------------- | -------------------------------------- |
| Required | false |
| Default Value | |
| Type | String |
| Hidden in portal | yes (preset via runbook customization) |
#### BrandingHeaderImageUrl
Header image of the report email (HTTPS URL, PNG/JPEG/GIF, max 200 KB). Taken from the tenant setting RJReport.Branding.HeaderImageUrl; the default RealmJoin header is used when empty.
| Property | Value |
| ---------------- | -------------------------------------- |
| Required | false |
| Default Value | |
| Type | String |
| Hidden in portal | yes (preset via runbook customization) |
#### BrandingFooterImageUrl
Footer image of the report email (HTTPS URL, PNG/JPEG/GIF, max 200 KB). Taken from the tenant setting RJReport.Branding.FooterImageUrl; the default RealmJoin footer is used when empty.
| Property | Value |
| ---------------- | -------------------------------------- |
| Required | false |
| Default Value | |
| Type | String |
| Hidden in portal | yes (preset via runbook customization) |
#### BrandingFooterLink
Link behind the footer image of the report email. Taken from the tenant setting RJReport.Branding.FooterLink; realmjoin.com is used when empty.
| Property | Value |
| ---------------- | -------------------------------------- |
| Required | false |
| Default Value | |
| Type | String |
| Hidden in portal | yes (preset via runbook customization) |
#### BrandingAccentColor
Accent color of the report email as a 6-digit hex value. Taken from the tenant setting RJReport.Branding.AccentColor; the RealmJoin default is used when empty or invalid.
| Property | Value |
| ---------------- | -------------------------------------- |
| Required | false |
| Default Value | |
| Type | String |
| Hidden in portal | yes (preset via runbook customization) |
#### BrandingTextColor
Text color of the report email as a 6-digit hex value. Taken from the tenant setting RJReport.Branding.TextColor; the RealmJoin default is used when empty or invalid.
| Property | Value |
| ---------------- | -------------------------------------- |
| Required | false |
| Default Value | |
| Type | String |
| Hidden in portal | yes (preset via runbook customization) |
#### ServiceDeskDisplayName
Service desk name shown in the email. Taken from the tenant setting RJReport.ServiceDesk\_DisplayName.
| Property | Value |
| ---------------- | -------------------------------------- |
| Required | false |
| Default Value | |
| Type | String |
| Hidden in portal | yes (preset via runbook customization) |
#### ServiceDeskEmail
Service desk email address shown in the email. Taken from the tenant setting RJReport.ServiceDesk\_EMail.
| Property | Value |
| ---------------- | -------------------------------------- |
| Required | false |
| Default Value | |
| Type | String |
| Hidden in portal | yes (preset via runbook customization) |
#### ServiceDeskPhone
Service desk phone number shown in the email. Taken from the tenant setting RJReport.ServiceDesk\_Phone.
| Property | Value |
| ---------------- | -------------------------------------- |
| Required | false |
| Default Value | |
| Type | String |
| Hidden in portal | yes (preset via runbook customization) |
#### ServiceDeskPortalUrl
Link to the service desk portal shown in the email. Taken from the tenant setting RJReport.ServiceDesk\_PortalUrl.
| Property | Value |
| ---------------- | -------------------------------------- |
| Required | false |
| Default Value | |
| Type | String |
| Hidden in portal | yes (preset via runbook customization) |
#### ServiceDeskTicketUrl
Link to the ticket for this request, shown in the email. Preset per run or in the runbook customization; empty means no link.
| Property | Value |
| ---------------- | -------------------------------------- |
| Required | false |
| Default Value | |
| Type | String |
| Hidden in portal | yes (preset via runbook customization) |
#### LanguageOverride
Forces the email language, DE or EN. Empty picks the language from the user's usage location. Preset in the runbook customization.
| Property | Value |
| ---------------- | -------------------------------------- |
| Required | false |
| Default Value | |
| Type | String |
| Hidden in portal | yes (preset via runbook customization) |
[Back to Runbook Reference overview](/automation/runbooks/runbook-references.md)
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.realmjoin.com/automation/runbooks/runbook-references/user/security/list-mfa-methods.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.