Troubleshooting combined security information registration

The information in this article is meant to guide admins who are troubleshooting issues reported by users of the combined registration experience.

Audit logs

The events logged for combined registration are in the Authentication Methods service in the Microsoft Entra audit logs.

The following table lists all audit events generated by combined registration:

Troubleshooting interrupt mode

Troubleshooting manage mode

How to roll back users

If you, as an admin, want to reset a user's multifactor authentication settings, you can use the PowerShell script provided in the next section. The script will clear the StrongAuthenticationMethods property for a user's mobile app and/or phone number. If you run this script for your users, they'll need to re-register for multifactor authentication if they need it. We recommend testing rollback with one or two users before rolling back all affected users.

The steps that follow will help you roll back a user or group of users.

Prerequisites

1. Install the appropriate Azure AD PowerShell modules. In a PowerShell window, run these commands to install the modules:

   Install-Module -Name MSOnline
   Import-Module MSOnline
   

2. Save the list of affected user object IDs to your computer as a text file with one ID per line. Make note of the location of the file.

3. Save the following script to your computer and make note of the location of the script:

   <# 
   //********************************************************
   //*                                                      *
   //*   Copyright (C) Microsoft. All rights reserved.      *
   //*                                                      *
   //********************************************************
   #>
   
   param($path)
   
   # Define Remediation Fn
   function RemediateUser {
   
       param  
       (
           $ObjectId
       )
   
       $user = Get-MsolUser -ObjectId $ObjectId
   
       Write-Host "Checking if user is eligible for rollback: UPN: "  $user.UserPrincipalName  " ObjectId: "  $user.ObjectId -ForegroundColor Yellow
   
       $hasMfaRelyingParty = $false
       foreach($p in $user.StrongAuthenticationRequirements)
       {
           if ($p.RelyingParty -eq "*")
           {
               $hasMfaRelyingParty = $true
               Write-Host "User was enabled for per-user MFA." -ForegroundColor Yellow
           }
       }
   
       if ($user.StrongAuthenticationMethods.Count -gt 0 -and -not $hasMfaRelyingParty)
       {
           Write-Host $user.UserPrincipalName " is eligible for rollback" -ForegroundColor Yellow
           Write-Host "Rolling back user ..." -ForegroundColor Yellow
           Reset-MsolStrongAuthenticationMethodByUpn -UserPrincipalName $user.UserPrincipalName
           Write-Host "Successfully rolled back user " $user.UserPrincipalName -ForegroundColor Green
       }
       else
       {
           Write-Host $user.UserPrincipalName " is not eligible for rollback. No action required."
       }
   
       Write-Host ""
       Start-Sleep -Milliseconds 750
   }
   
   # Connect
   Import-Module MSOnline
   Connect-MsolService -AzureEnvironment AzureChinaCloud
   
   foreach($line in Get-Content $path)
   {
       RemediateUser -ObjectId $line
   }
   

Rollback

In a PowerShell window, run the following command, providing the script and user file locations. Provide at least Privileged Authentication Administrator credentials when prompted. The script will output the outcome of each user update operation.

<script location> -path <user file location>

Next steps

• Learn more about combined registration for self-service password reset and Microsoft Entra multifactor authentication