Query Details
Identity Visualize MFA Methodsovertime
Query
//Visualize the MFA types used by your users - phone sign in, mobile passcode, push or text message, over time //Data connector required for this query - Azure Active Directory - Signin Logs SigninLogs | where TimeGenerated > ago (180d) | where AuthenticationRequirement == "multiFactorAuthentication" | project TimeGenerated, AuthenticationDetails | extend ['MFA Method'] = tostring(parse_json(AuthenticationDetails)[1].authenticationMethod) | summarize Count=count()by ['MFA Method'], bin(TimeGenerated, 7d) | where ['MFA Method'] != "Previously satisfied" and isnotempty(['MFA Method']) | render timechart with (ytitle="Count", xtitle="Day", title="MFA methods per week over time")
Explanation
This query analyzes the MFA (Multi-Factor Authentication) types used by users over time. It requires the Azure Active Directory - Signin Logs data connector.
The query filters the signin logs for the past 180 days and selects only the entries where multi-factor authentication was required. It then projects the time generated and authentication details columns.
Next, it extends the 'MFA Method' column by extracting the authentication method from the authentication details using JSON parsing.
The query then summarizes the count of each MFA method used, grouping them by week. It filters out any entries where the MFA method is "Previously satisfied" or empty.
Finally, it renders a time chart showing the count of MFA methods per week over time, with the y-axis representing the count and the x-axis representing the day.
Details
Matt Zorich
Released: June 17, 2022
Tables
Keywords
Operators