topic Re: Can we search for a users MFA phone number in Peer-Peer Topics

Can we search for a users MFA phone number

jasoncrcsd — Thu, 14 Sep 2023 14:26:37 GMT

We keep getting Googles call for a users MFA on our office line. Some suer must have set it for their MFA. IS there any way to search by that phone number to find out which user it is?

Re: Can we search for a users MFA phone number

James_Seymour — Thu, 14 Sep 2023 23:55:08 GMT

In the Admin Console, I assume it is the recovery phone that you are looking for. You can also retreive this info for multiple users using GAMADV-XTD3 (https://github.com/taers232c/GAMADV-XTD3/wiki)

Re: Can we search for a users MFA phone number

Kim_Nilsson — Fri, 15 Sep 2023 06:06:07 GMT

Actually, the Recovery Phone number and Two-Step Verification (2SV/2FA) phone number are not at all the same thing.

Using SMS/Call as a 2FA method does not add the number as recovery method, as that is a completely separate process, and actually should never be used in a Workspace environment. The user should either use 2FA or contact their (closest) admin if having issues with logging into their account.

There is also, AFAIK, no known method of reading the current 2FA number. Only whether the user is enrolled in 2FA or not.

In Reports one can also see which method is used when the user logs in, but no details about number is shown.

Re: Can we search for a users MFA phone number

robbabiak — Fri, 15 Sep 2023 14:35:22 GMT

Depending on how may users you have signing in at the same time you "may" be able to determine who is generating that call by correlating a "Login verification" event in the Investigation Tool.

It might require checking other events as well, I've never tried this before and this solution is me "thinking out loud"