I have a PowerShell script that launches the Company Portal so users can complete MFA during their first sign-in. Once MFA is finished, OneDrive can sign in and begin syncing automatically. The process works, but my custom dialog currently watches for the OneDrive sign-in, which can take several minutes after MFA is completed. Is there a token, event, or other reliable signal I can check so the dialog updates sooner when the user finishes MFA registration or authentication?
5 Answers
Before adding a Graph dependency, consider whether you really need sub-minute detection. For a migration or enrollment project, a report run periodically may be enough. If the dialog must react immediately, Graph or registration events are the likely options, but neither should be treated as a guaranteed replacement for waiting on the client sign-in state.
There are built-in Entra features for this, including Registration Campaign, which can encourage or require users to register for MFA. If you have the appropriate Entra licensing, the admin center also provides reports showing registration status. For larger rollouts, scheduled reporting may be safer and simpler than running a privileged check on every device.
Microsoft Graph can also query a user’s authenticationMethods collection. That can tell you whether their registered methods have changed, although it may not be a perfect real-time signal for the completion of an interactive MFA prompt.
You could query Microsoft Graph, but you would need to register an Entra ID application with permission to read authentication-method information. Be cautious about deploying a script with access to users’ authentication data on every endpoint, especially with non-interactive permissions.
What makes this approach unnecessary? I’m mainly trying to update the dialog immediately instead of waiting for OneDrive to finish signing in.
If the goal is tracking MFA registration rather than detecting the exact sign-in completion, use the authentication-method registration and reset events in the Entra admin center. You can filter the activity type and see when users register or update their methods.
A similar campaign for passwordless authentication and passkeys is also expected to become available, so the built-in enrollment tools may cover more of this workflow over time.