MFA Authenticator - Which Field and Which App Setup

Hi jeffpahf , I dont think you'll be able to tell what app was used as usually 2FA setup doesnt send any communication back to the service from the 2FA app. 2FA QR codes are usually pretty generic with most apps and will work on both Google Authenticator or Microsoft Authenticator. It's only bespoke functions like Microsoft Authenticator's "Notification" authorisation method that would use a different type of setup.

Yeah, I rather thought determining which Auth App did the deed wouldn't be available, but I didn't want to overlook that, in case it was patently obvious by looking at the string in the ToTPAccount (still not 100% sure this is the field) considering a security audit, when asked if Google Auth app had a security flaw, how many active accounts/users have this as their method and recent connections by those users... 

TOTP Time-based One Time Password, if that is present in Exported Users, then MFA is Activated
That doesn't mean that it's truly Active if MFA is Enabled and not Enforced (required), when Enabled the user dialog for both setup and entering an MFA includes Skip