Forum Discussion
View and unblock users that are blocked by MFA using Powershell
AloisPommerais
Not sure how far you got on this, but this is what i have done in the sense of get the blocked accounts, based on the feedback from Compulinx above.Import-Module Microsoft.Graph.Reports Connect-Graph -Scopes "AuditLog.Read.All" -TenantId "{TENANT_ID}" $Filter = "activityDisplayName eq 'Fraud reported - user is blocked for MFA'" Get-MgAuditLogDirectoryAudit -Filter $Filter | Select -ExpandProperty TargetResources
So now i can see that something/Someone have reported fraud, next step is how to unblock.
Hope that help others on the way, please revert if you have a way of showing who it is and how to unblock.
//A
This is the rest call to find the blocked users:
$filters= "activityDisplayName eq 'Fraud reported - user is blocked for MFA'"
$uri = "https://graph.microsoft.com/beta/auditLogs/directoryaudits?api-version=beta&filter=$($filters)"
Compulinx
Hello, can i have more information regarding your last message ?
Thanks a lot
AloisPommerais
Not sure how far you got on this, but this is what i have done in the sense of get the blocked accounts, based on the feedback from Compulinx above.Import-Module Microsoft.Graph.Reports Connect-Graph -Scopes "AuditLog.Read.All" -TenantId "{TENANT_ID}" $Filter = "activityDisplayName eq 'Fraud reported - user is blocked for MFA'" Get-MgAuditLogDirectoryAudit -Filter $Filter | Select -ExpandProperty TargetResources
So now i can see that something/Someone have reported fraud, next step is how to unblock.
Hope that help others on the way, please revert if you have a way of showing who it is and how to unblock.- Yep pretty good jvinterberg. The API call I use is:
$uri = "https://graph.microsoft.com/v1.0/auditLogs/directoryAudits?`$filter=category eq 'UserManagement' and activitydisplayname eq 'Fraud reported - user is blocked for MFA"
Works nicely
