Blog Post

ITOps Talk Blog
2 MIN READ

PowerShell Basics: How to check if MFA is enabled in Azure and Office 365

AnthonyBartolo's avatar
AnthonyBartolo
Icon for Microsoft rankMicrosoft
Jun 25, 2020
Security governance has been top of mind for most since the onslaught of human malware has the masses working from home.  This comes with new concerns surrounding identity protection and actually pro...
Updated Apr 27, 2021
Version 3.0
Anthony Bartolo
azure
powershell
security
D0mp13's avatar
D0mp13
Copper Contributor
Feb 16, 2021

I stumbled upon this article and this script is wrong in the core of it.


There is a difference between having StrongAuthenticationMethods configured and enabling MFA. You can register an alternate email or phonenumber without MFA being enforced or enabled.


To know if a user is MFA enabled or not is stored in StrongAuthenticationRequirements their state.


f.e.:

$Req = (Get-MsolUser -UserPrincipalName $UserObject.UserPrincipalName).StrongAuthenticationRequirements
if (($Req.State -eq "Enabled") -or ($Req.State -eq "Enforced")){
      Write-Host "MFA Enabled or Enforced"
}

I even suspect that this bug is present in the Extension for Azure MFA v1.0.1.35 (8/17/2020) because we see the same behavior when we use the NPS extension. It sends an MFA challenge even if MFA isn't enabled/enforced.
(https://www.microsoft.com/en-us/download/details.aspx?id=54688)