List Mfa Methods

List the MFA and authentication methods of this user

Description

Shows every authentication method registered for this user in Entra ID, including the phone numbers of phone-based methods. Phone numbers can be masked to their last four digits. Optionally the user gets an email that an administrator has looked at their methods. Nothing is changed.

Privacy and audit

This runbook reads sensitive identity data: the registered MFA methods of a user, including phone numbers. Phone numbers are masked by default. Set MaskPhoneNumbers to false only when the full numbers are required for legitimate support purposes; the action is logged together with the caller name.

Activate user notification

This runbook can optionally send a notification email to the target user informing them that their MFA methods were retrieved by an administrator. To enable this, you need to activate user notification in the runbook customization.

The json configuration for this is as follows:

"rjgit-user_security_list-mfa-methods": {
    "parameters": {
        "UserName": {
            "Hide": true
        },
        "NotifyUser": {
            "Default": true,
            "Hide": true
        },
        "MaskPhoneNumbers": {
            "Hide": true
        },
        "EmailFrom": {
            "Hide": true
        },
        "ServiceDeskDisplayName": {
            "Hide": true
        },
        "ServiceDeskEmail": {
            "Hide": true
        },
        "ServiceDeskPhone": {
            "Hide": true
        },
        "ServiceDeskPortalUrl": {
            "Hide": true
        },
        "ServiceDeskTicketUrl": {
            "Hide": true
        },
        "LanguageOverride": {
            "Hide": true
        },
        "CallerName": {
            "Hide": true
        }
    }
}

For more information on how to customize runbooks, please refer to the Runbook Customization Guide.

Setup regarding email sending

Sending a notification email is optional and only happens when NotifyUser is enabled. The sender address is taken from the RJReport.EmailSender tenant setting.

This runbook sends emails using the Microsoft Graph API. To send emails via Graph API, you need to configure an existing email address in the runbook customization.

See the RealmJoin Report Settings documentation for details on all available settings.

Email branding

The report email honors the optional RJReport.Branding.* tenant settings:

• Header and footer image – public HTTPS URLs, PNG/JPEG/GIF, max. 200 KB each
• Footer link – target of the footer image
• Accent and text color – 6-digit hex values, e.g. #0052cc

When these settings are not configured, the default RealmJoin graphics and colors are used. An image that cannot be downloaded or validated, or an invalid color value, never prevents the report email – the corresponding default is used instead.

Setup instructions and image requirements: Email branding.

Location

User → Security → List MFA Methods

Full Runbook name

rjgit-user_security_list-MFA-methods

Details

Property	Value
Version	1.2.0
Required modules	RealmJoin.RunbookHelper (>= 0.8.9) Microsoft.Graph.Authentication (>= 2.39.0)
Schedulable	no

Permissions

Application permissions

• Type: Microsoft Graph

  • Mail.Send (optional — feature: Email report)

    • Sends the MFA-lookup notification mail to the user's mailbox via Send-RjReportEmail when notification is enabled
  • Organization.Read.All

    • Reads /organization to put the tenant name into the notification email
  • User.Read.All

    • Resolves the target user to get id, mail, accountEnabled and usageLocation
  • UserAuthenticationMethod.Read.All

    • Lists the user's registered MFA methods including phone numbers and FIDO2 details

Parameters

UserName

User principal name of the user the runbook acts on. Set by the portal from the selected user.

Property	Value
Required	true
Default Value
Type	String
Hidden in portal	yes (preset via runbook customization)

NotifyUser

Whether the user is emailed that their methods were looked up. Preset in the runbook customization.

Property	Value
Required	false
Default Value	False
Type	Boolean
Hidden in portal	yes (preset via runbook customization)

MaskPhoneNumbers

Whether phone numbers are shown masked, with only the last four digits. Preset in the runbook customization.

Property	Value
Required	false
Default Value	False
Type	Boolean
Hidden in portal	yes (preset via runbook customization)

EmailFrom

Sender address of the notification email. Taken from the tenant setting RJReport.EmailSender.

Property	Value
Required	false
Default Value
Type	String
Hidden in portal	yes (preset via runbook customization)

BrandingHeaderImageUrl

Header image of the report email (HTTPS URL, PNG/JPEG/GIF, max 200 KB). Taken from the tenant setting RJReport.Branding.HeaderImageUrl; the default RealmJoin header is used when empty.

Property	Value
Required	false
Default Value
Type	String
Hidden in portal	yes (preset via runbook customization)

BrandingFooterImageUrl

Footer image of the report email (HTTPS URL, PNG/JPEG/GIF, max 200 KB). Taken from the tenant setting RJReport.Branding.FooterImageUrl; the default RealmJoin footer is used when empty.

Property	Value
Required	false
Default Value
Type	String
Hidden in portal	yes (preset via runbook customization)

BrandingFooterLink

Link behind the footer image of the report email. Taken from the tenant setting RJReport.Branding.FooterLink; realmjoin.com is used when empty.

Property	Value
Required	false
Default Value
Type	String
Hidden in portal	yes (preset via runbook customization)

BrandingAccentColor

Accent color of the report email as a 6-digit hex value. Taken from the tenant setting RJReport.Branding.AccentColor; the RealmJoin default is used when empty or invalid.

Property	Value
Required	false
Default Value
Type	String
Hidden in portal	yes (preset via runbook customization)

BrandingTextColor

Text color of the report email as a 6-digit hex value. Taken from the tenant setting RJReport.Branding.TextColor; the RealmJoin default is used when empty or invalid.

Property	Value
Required	false
Default Value
Type	String
Hidden in portal	yes (preset via runbook customization)

ServiceDeskDisplayName

Service desk name shown in the email. Taken from the tenant setting RJReport.ServiceDesk_DisplayName.

Property	Value
Required	false
Default Value
Type	String
Hidden in portal	yes (preset via runbook customization)

ServiceDeskEmail

Service desk email address shown in the email. Taken from the tenant setting RJReport.ServiceDesk_EMail.

Property	Value
Required	false
Default Value
Type	String
Hidden in portal	yes (preset via runbook customization)

ServiceDeskPhone

Service desk phone number shown in the email. Taken from the tenant setting RJReport.ServiceDesk_Phone.

Property	Value
Required	false
Default Value
Type	String
Hidden in portal	yes (preset via runbook customization)

ServiceDeskPortalUrl

Link to the service desk portal shown in the email. Taken from the tenant setting RJReport.ServiceDesk_PortalUrl.

Property	Value
Required	false
Default Value
Type	String
Hidden in portal	yes (preset via runbook customization)

ServiceDeskTicketUrl

Link to the ticket for this request, shown in the email. Preset per run or in the runbook customization; empty means no link.

Property	Value
Required	false
Default Value
Type	String
Hidden in portal	yes (preset via runbook customization)

LanguageOverride

Forces the email language, DE or EN. Empty picks the language from the user's usage location. Preset in the runbook customization.

Property	Value
Required	false
Default Value
Type	String
Hidden in portal	yes (preset via runbook customization)

Back to Runbook Reference overview