View and unblock users that are blocked by MFA using Powershell

How can I view and unblock uses that have become blocked using MFA in Powershell The following https://aad.portal.azure.com/#blade/Microsoft_AAD_IAM/MultifactorAuthenticationMenuBlade/BlockedUser...

Azure Active Directory (AAD)

Identity Management

microsoft 365

jvinterberg
Nov 23, 2022
AloisPommerais

Not sure how far you got on this, but this is what i have done in the sense of get the blocked accounts, based on the feedback from Compulinx above.

Import-Module Microsoft.Graph.Reports Connect-Graph -Scopes "AuditLog.Read.All" -TenantId "{TENANT_ID}" $Filter = "activityDisplayName eq 'Fraud reported - user is blocked for MFA'" Get-MgAuditLogDirectoryAudit -Filter $Filter | Select -ExpandProperty TargetResources

So now i can see that something/Someone have reported fraud, next step is how to unblock.
Hope that help others on the way, please revert if you have a way of showing who it is and how to unblock.

Greg Allen

Copper Contributor

Apr 14, 2021

Compulinx

Did you ever find a solution for this ? Am needing the same myself.

thanks

Compulinx
Copper Contributor
Apr 14, 2021
Nope!

//A
- Compulinx
  Copper Contributor
  Jan 27, 2022
  Actually partially yes..
  
  This is the rest call to find the blocked users:
  $filters= "activityDisplayName eq 'Fraud reported - user is blocked for MFA'"
  $uri = "https://graph.microsoft.com/beta/auditLogs/directoryaudits?api-version=beta&filter=$($filters)"
  - AloisPommerais
    Copper Contributor
    Apr 13, 2022
    Compulinx
    Hello, can i have more information regarding your last message ?
    Thanks a lot

Forum Discussion

View and unblock users that are blocked by MFA using Powershell