Get EntraIDMFAAuthenticationMethodUsage

<#
.SYNOPSIS
    Reports on the distribution of MFA methods registered by users.

.DESCRIPTION
    <!-- library-status:start -->
    Prüfstatus: Ungeprüft
    Windows- und Tenant-Abnahme ausstehend; keine pauschale Produktionsfreigabe.

    <!-- library-status:end -->

    Analyzes which authentication methods users have registered (Microsoft Authenticator, SMS, Phone, FIDO2).
    Helpful for driving migration from SMS to Authenticator App.

.NOTES
    File Name  : 114_Get-EntraIDMFAAuthenticationMethodUsage.ps1
    Author     : Kaffeeundcode
    Version    : 1.0
#>

try {
    Connect-MgGraph -Scopes "UserAuthenticationMethod.Read.All", "User.Read.All" -ErrorAction Stop
} catch {
    Write-Error "Login failed"
    exit
}

Write-Host "This report requires scanning every user. This may take a while." -ForegroundColor Yellow
$Users = Get-MgUser -All -Filter "userType eq 'Member'"
$TotalUsers = $Users.Count

$MethodCounts = @{
    "microsoftAuthenticator" = 0
    "phoneNumber" = 0 # SMS/Voice
    "fido2" = 0
    "windowsHelloForBusiness" = 0
    "email" = 0
    "softwareOath" = 0
    "None" = 0
}

$Progress = 0
foreach ($User in $Users) {
    $Progress++
    Write-Progress -Activity "Scanning MFA Methods" -Status "$($User.UserPrincipalName)" -PercentComplete (($Progress / $TotalUsers) * 100)

    try {
        $Methods = Get-MgUserAuthenticationMethod -UserId $User.Id -ErrorAction SilentlyContinue
        if ($Methods) {
            foreach ($M in $Methods) {
                if ($MethodCounts.ContainsKey($M.AdditionalProperties["@odata.type"].Split(".")[-1])) {
                     # Simplified type matching
                     # e.g. #microsoft.graph.microsoftAuthenticatorAuthenticationMethod
                     $Type = $M.AdditionalProperties["@odata.type"].Split(".")[-1]
                     $MethodCounts[$Type]++
                } else {
                    $Type = $M.AdditionalProperties["@odata.type"].Split(".")[-1]
                    # Add dynamic key if new
                    if (-not $MethodCounts.ContainsKey($Type)) { $MethodCounts[$Type] = 1 } else { $MethodCounts[$Type]++ }
                }
            }
        } else {
            $MethodCounts["None"]++
        }
    } catch {
        $MethodCounts["None"]++
    }
}

Write-Host "MFA Method Distribution:" -ForegroundColor Cyan
$MethodCounts.GetEnumerator() | Sort-Object Value -Descending | Format-Table Name, Value -AutoSize

# Generate simple CSV
$MethodCounts.GetEnumerator() | Select-Object Key, Value | Export-Csv "$PSScriptRootMFA_Stats.csv" -NoTypeInformation