Created by Claude - please verify

Shared MFA phone numbers - phone methods read per user by an on-demand scan; numbers are masked on screen and in exports.

Required Microsoft Graph permissions

UserAuthenticationMethod.Read.All — application permission, granted to the app registration with admin consent.

Endpoints: GET /v1.0/reports/authenticationMethods/userRegistrationDetails (who has a phone method) · GET /v1.0/users/{id}/authentication/phoneMethods (per user)

Only users whose registration details list a phone method are read (the MFA registration cache must be loaded before you start the scan). SMS and voice are the weakest MFA methods - the long-term fix is the Authenticator app or passkeys.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Phone Numbers Shared Across MFA Registrations

When several accounts use the same phone number for MFA, whoever holds that phone - or takes it over with a SIM swap - can approve sign-ins for all of them. Shared numbers are usually a team phone, a manager's mobile or a help-desk number; shared by an admin they are a real risk.

Press Run scan to read the phone methods of every user who registered one.