Forum Discussion

ABaerst's avatar
ABaerst
Brass Contributor
Feb 13, 2018
Solved

Powershell CMDlets for MFA Settings?

Does anyone know if there are Powershell Cmdlets available to allow inspection of a user's MFA settings related to which verification options were configured and which option is considered primary? I...
Azure Active Directory (AAD)
Identity Management
microsoft 365
  • Pablo R. Ortiz's avatar
    Pablo R. Ortiz
    Feb 13, 2018

    You have the information in the Get-MSolUser cmdlet from MSOnline powershell module:

    Connect-MsolService
$User = Get-MSolUser -UserPrincipalName user@domain.com
    $User.StrongAuthenticationMethods

    With that you get the default authentication method. There are other properties beginning by StrongAuthentication that give you other details

Dale Robertson's avatar
Dale Robertson
Copper Contributor
May 31, 2018

I need a PS script that generates a CSV showing not only if MFA is enabled for all users, but shows the authentication method as well.

 

Thank You in advance.

Gary Long's avatar
Gary Long
Copper Contributor
May 31, 2018

Try this (has to be done on a per-group basis):

$filepath = '<your-export-filename>'
Get-MsolGroupMember -GroupObjectId <the id number of the group> -MemberObjectTypes User -All | Get-MsolUser | Where {$_.UserPrincipalName} | Select UserPrincipalName, DisplayName, Country, Department, Title, @{n="MFA"; e={$_.StrongAuthenticationRequirements.State}}, @{n="Methods"; e={($_.StrongAuthenticationMethods).MethodType}}, @{n="Default Method"; e={($_.StrongAuthenticationMethods).IsDefault}} | Export-Csv -Path $filepath

  • Dale Robertson's avatar
    Dale Robertson
    Copper Contributor
    May 31, 2018

    Thank You.

    So by Group, do you mean all the users must be in some type of GROUP?

    [Distro, O365 Group,..]

     

    • Gary Long's avatar
      Gary Long
      Copper Contributor
      May 31, 2018

      This specific PS command relies upon the Group Object ID which is unique to the specific group.  For instance, if you have an All Users group, you would need to provide.  It's a number that looks similar to this: af407072-7ae1-4b07-a0ca-6634b7396054

      • Plantagenet's avatar
        Plantagenet
        Copper Contributor
        Nov 29, 2018

        Is it possible to edit the value of the strongauthenticationmethod?

         

        So I want to switch the IsDefault value in my case from PhoneAppOTP to PhoneAppNotification

         

        I was hoping I was just going to be able to use

         

        Set-MsolUser -UserPrincipalName myuser@mycompany.com -StrongAuthenticationMethods phoneappnotification

         

        But this doesn't seem to be the correct methodology.  Any guidance would be apprciated

Resources