How to list authentication strengths in Microsoft Entra ID

Before you start

Use an account in the Security Reader, Security Administrator or Conditional Access Administrator role. The PowerShell example requests Policy.Read.All, which covers both the strengths and the Conditional Access policies; your organisation may require administrator consent.

Know what a strength is. It lists combinations of authentication methods, such as a password with a Microsoft Authenticator push, and a sign-in meets it with any 1 of them. The built-in strengths can't be changed, and Microsoft updates them when new methods arrive; a tenant can add up to 15 custom ones. The examples read and export; they don't change any strength or policy.

Option 1

List authentication strengths with PowerShell

Install the modules once, then connect and export each strength with the policies that require it.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.Identity.SignIns -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'Policy.Read.All' -NoWelcome
try {
    $strengths = @(Get-MgPolicyAuthenticationStrengthPolicy)
    $policies = @(Get-MgIdentityConditionalAccessPolicy -All)
    $report = @(foreach ($strength in $strengths | Sort-Object PolicyType, DisplayName) {
        $requiring = @($policies | Where-Object {
            $_.GrantControls.AuthenticationStrength.Id -eq $strength.Id
        })
        $names = $requiring | ForEach-Object { "$($_.DisplayName) ($($_.State))" }
        [pscustomobject]@{
            Strength     = $strength.DisplayName
            Type         = $strength.PolicyType
            Combinations = @($strength.AllowedCombinations) -join '; '
            Satisfies    = $strength.RequirementsSatisfied
            Modified     = $strength.ModifiedDateTime
            RequiredBy   = @($names) -join '; '
        }
    })
    if ($report.Count -eq 0) {
        Write-Output 'No authentication strength could be read.'
    } else {
        $path = './authentication-strengths.csv'
        $report | Export-Csv -Path $path -NoTypeInformation -Encoding utf8
        $unused = @($report | Where-Object { -not $_.RequiredBy }).Count
        Write-Output "$($report.Count) authentication strengths; no policy requires $unused."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

Each row is 1 strength, the built-in ones first. Combinations uses Microsoft's names, such as password,microsoftAuthenticatorPush for a password with an Authenticator push, and Satisfies is mfa when meeting the strength also counts as multifactor authentication. RequiredBy gives each policy with its state: a strength required only by policies that are off or report-only enforces nothing.

List the custom strengths only

Reconnect with Connect-MgGraph, then filter on the type. The filter runs in Microsoft Graph.

# Run while connected to Microsoft Graph.
Get-MgPolicyAuthenticationStrengthPolicy -Filter "policyType eq 'custom'" |
    Select-Object DisplayName, AllowedCombinations, ModifiedDateTime

Option 2

Review authentication strengths in the admin centre

1. Sign in to the Microsoft Entra admin centre as at least a Security Reader.
2. Go to Entra ID > Authentication methods > Authentication strengths.
3. Select a strength to see the method combinations it allows.
4. To see which strength a policy requires, go to Entra ID > Conditional Access > Policies, select the policy and open Grant under Access controls: Require authentication strength names it.
5. Close each page without saving anything.

This suits reading 1 strength or 1 policy. Matching every strength with every policy means opening each policy in turn, so for the whole tenant, use PowerShell or a report.

Common questions

Can I change a built-in strength?

No. Built-in strengths are read only, so make a custom strength with the combinations you want. For a passkey (FIDO2), a custom strength can also limit which security key models are allowed.

Why can't a person meet a strength?

A combination counts only when its methods are turned on in the authentication methods policy and the person has registered 1 of them. Check the policy first; see how to check the authentication methods policy.

Do strengths work for guests?

Only for external users who authenticate with Microsoft Entra ID. For email one-time passcode, SAML or WS-Fed and Google federation users, Microsoft says to use the Require multifactor authentication grant control instead.