MFA Security Issues

How to Find When a Device or MFA Method Was Added in Microsoft 365

WPS Editor Oct 8, 2026 870 views

Question details

The administrator needs to determine the exact time and date a new device or multifactor authentication (MFA) method was added to a user's Microsoft Entra account.

How to Find When a Device or MFA Method Was Added in Microsoft 365

Product: Microsoft 365 / Microsoft Entra ID
Device & OS: not provided
Scenario: Investigating a suspected account compromise to identify if and when an unauthorized MFA method or device was registered.
Observed behavior: Standard sign-in logs do not clearly display when a new authentication method is registered, requiring deeper investigation into specific audit events.

Before you start

Ensure you have the necessary administrative privileges, such as Global Administrator, Security Administrator, or Security Reader, in your Microsoft Entra ID (formerly Azure AD) environment to access audit logs.

Solution 1Recommended

Review Microsoft Entra Audit Logs for Registration Events

The most reliable way to find when a new MFA method was added is by checking the specific security info registration events within the Microsoft Entra Audit Logs.

Audit logs track all identity-related changes, including updates to security methods. Standard sign-in logs only show authentication attempts, whereas audit logs record the actual registration of the new device or method.

Access Microsoft Entra admin center

Navigate to the specific user

Go to Identity > Users > All users. Search for and select the user whose MFA setup you are investigating.

Open Audit logs

In the left-hand navigation menu for the selected user, click on 'Audit logs' under the Activity section.

Filter the activity

Set the date range to cover the period of the suspected compromise. Look for events labeled 'Registered security info', 'Update user', or 'User registered security info'. Clicking on these events will reveal the timestamp and details of the newly added MFA method.

Review Microsoft Entra Audit Logs for Registration Events

Log Retention Limits: Keep in mind that audit logs are retained for 7 days on free tiers, and up to 30 days for tenants with Microsoft Entra ID P1 or P2 licenses.

Solution 2

Examine Sign-in Logs and Authentication Activity

If audit logs are inconclusive or have expired, reviewing the user's sign-in logs can help pinpoint when a new authentication method was first used.

Solution 3

Consult Microsoft Support and Authenticator Forums

If the built-in logs do not provide the necessary details or if you require deep forensic analysis regarding the Microsoft Authenticator app, escalating the issue may be required.

Free Microsoft Office alternative

A Secure and Lightweight Alternative for Your Daily Workflows

While managing administrative tasks and securing user accounts in Microsoft 365, you may need a reliable office suite for daily document workflows. WPS Office offers a free, lightweight, and highly compatible alternative to Microsoft Office, allowing you to seamlessly edit Word, Excel, and PowerPoint files.

1. Download the installer: Visit the official WPS Office website and download the free installation package for your operating system.
2. Install WPS Office: Run the downloaded installer and follow the simple on-screen instructions to set up the suite.
3. Open and edit your files: Launch WPS Office and open your existing Microsoft Office documents to enjoy seamless editing and formatting compatibility.

Completely free and lightweight Office suiteSeamless compatibility with Microsoft Word, Excel, and PowerPoint formatsBuilt-in PDF editing and local document encryption featuresFamiliar, intuitive user interface allowing for an easy migration without a learning curve

microsoft office alternative - wps office

Frequently Asked Questions

How long are Microsoft Entra audit logs retained?

Microsoft Entra ID retains audit logs based on your licensing tier. For free or basic tiers, logs are typically retained for 7 days. For Microsoft Entra ID P1 or P2 licenses, audit and sign-in logs are kept for 30 days.

Why doesn't the standard sign-in log show the MFA device registration time?

Standard sign-in logs only record the authentication event itself (e.g., successful or failed login). The actual action of adding a new MFA method is considered an administrative or profile change, which is strictly tracked under Audit Logs as an 'Update user' or 'Registered security info' event.

Can end-users see when their own MFA devices were added?

End-users can view their currently active MFA devices and methods by logging into their Microsoft account and navigating to the 'Security info' page. However, they may not see detailed historical timestamps of exactly when each method was added; this level of logging is usually restricted to administrators in the Entra admin center.

Microsoft Office Security Issues