Capture Azure MFA enrollment event - azure

Question

I am looking to automate adding a user to an Azure AD group when he/she enrolls into MFA using the http://aka.ms/mfasetup wizard.
When: User enrolls into MFA
Action: Add user to Azure AD Security Group "0000_People_with_MFA"
I looked at Microsoft Power Automate but there does not appear to be any triggers from Azure AD. I can perhaps use a webhook or something to call a PowerShell script running on Azure Functions, but there needs to be some way of capturing this event.
Alternatively I can run something from Azure Functions to query AAD every 10 or 15 minutes to add users, but I do not know how to go about that approach either. In pseudo-code it would look something like this:
for (let user of query("SELECT userPrincipalName FROM users WHERE mfaEnabled = 1"))
addToAADGroup("0000_People_with_MFA", user)
Any ideas on how this can be accomplished?

Answer 1

You can use these PowerShell cmdlets to get list of users with MFA Enabled:
Install-Module MSOnline If the module is not installed already.
Connect-MsolService Login with Global Admin account.
Get-MsolUser -All | select DisplayName,BlockCredential,UserPrincipalName,#{N="MFA Status"; E={ if( $_.StrongAuthenticationRequirements.State -ne $null){ $_.StrongAuthenticationRequirements.State} else { "Disabled"}}} To get a list of users with MFA Enabled
Then you can use Add-AzureADGroupMember to add the users to the group. You can also add the users to a CSV file and bulk add them to a group. (See also.)
I would also recommend checking out the Graph API, where you can query a list of user registration details. https://learn.microsoft.com/en-us/graph/api/resources/credentialuserregistrationdetails?view=graph-rest-beta