Report on MFA Status with Conditional Access

[NidalT]

Is there any effective way to get a report of the actual MFA state of your users?

I mean, the individual MFA state as well as MFA enabled via Conditional Access.

It's easy to report on the individual MFA state. You get nice results: Enabled, Disabled, Enforced...

However, if MFA is enabled via Conditional Access I can't seem to find an effective way to report on them.

Below Powershell snippet is the closest I can get.
It will check if MFA is enabled individually. If not, it will check the "StrongAuthenticationMethods.IsDefault" attribute and report on that.

But this is not always accurate, because if the "Phone" or "Alternate Phone" are configured in the Azure user object, it will still report it here even if the user is not member of a Conditional Access policy.

There is a built-in Azure report for this, but it is completely incorrect. It says that, for instance, I'm not enabled for MFA even though I'm enabled for the last 6 years.

Report: https://portal.azure.com/#blade/Microsoft_AAD_IAM/AuthMethodsOverviewBlade

Has anyone figured this out yet?

$user = get-msoluser -UserPrincipalName yourUserName@contoso.com

$StrongAuthenticationMethodsresult = $user.StrongAuthenticationMethods | Select-Object MethodType, IsDefault

[PSCustomObject]@{
  UserPrincipalName             = $user.UserPrincipalName
  ObjectID                      = $user.objectid
  DisplayName                   = $user.DisplayName
  AuthEmail                     = $user.StrongAuthenticationUserDetails.Email
  AuthPhoneNumber               = $user.StrongAuthenticationUserDetails.PhoneNumber
  PhoneDeviceName               = $user.StrongAuthenticationPhoneAppDetails.DeviceName
  AuthAltPhone                  = $user.StrongAuthenticationUserDetails.AlternativePhoneNumber

  State                         = if ($user.StrongAuthenticationRequirements.State -ne $null) { $user.StrongAuthenticationRequirements.State } elseif ( $user.StrongAuthenticationMethods.IsDefault -eq $true) { "ConditionalAccess ($(($user.StrongAuthenticationMethods| Where IsDefault -eq $True).MethodType))" } else { "Disabled" }

  PhoneAppNotification          = if ($StrongAuthenticationMethodsresult | Where-Object { $_.MethodType -eq "PhoneAppNotification" }) { $true } else { $false }
  PhoneAppNotificationIsDefault = IF (  ($StrongAuthenticationMethodsresult | Where-Object { $_.MethodType -eq "PhoneAppNotification" }).isDefault -eq "True") { $true } Else { $false }

  PhoneAppOTP                   = if ($StrongAuthenticationMethodsresult | Where-Object { $_.MethodType -eq "PhoneAppOTP" }) { $true } else { $false }
  PhoneAppOTPIsDefault          = IF (  ($StrongAuthenticationMethodsresult | Where-Object { $_.MethodType -eq "PhoneAppOTPIsDefault" }).isDefault -eq "True") { $true } Else { $false }

  TwoWayVoiceMobile             = if ($StrongAuthenticationMethodsresult | Where-Object { $_.MethodType -eq "TwoWayVoiceMobile" }) { $true } else { $false }
  TwoWayVoiceMobileIsDefault    = IF (  ($StrongAuthenticationMethodsresult | Where-Object { $_.MethodType -eq "TwoWayVoiceMobileIsDefault" }).isDefault -eq "True") { $true } Else { $false }

  OneWaySMS                     = if ($StrongAuthenticationMethodsresult | Where-Object { $_.MethodType -eq "OneWaySMS" }) { $true } else { $false }
  OneWaySMSIsDefault            = IF (  ($StrongAuthenticationMethodsresult | Where-Object { $_.MethodType -eq "OneWaySMSIsDefault" }).isDefault -eq "True") { $true } Else { $false }
}

[#2]

@NidalT 

I've been using this script, it reports on users that are mfa enforced via CA policy and have a disabled mfa user state.

https://gallery.technet.microsoft.com/office/Export-Office-365-Users-81747c73

[#3]

@n3vers 
Thanks. I already came across that script.

It basically does the same as mine.

It's not accurate.

If there is a Conditional Access policy, but due to some conditions a particular account is not affacted by it and he has an Authentication Phone configured, the script (like mine) will report that MFA is enabled even though it's not enforced.

We have a couple of these accounts in our environment.

While everything is under control here, I wanted to have a reliable report where I can look at occasionally to identify such accounts if they, for some reason, slip through.

[#4]

@NidalT 
Did you ever find an accurate way to report on MFA as have just found our current reporting have the same issue.

[#5]

Unfortunately no. Once you switch to MFA via Conditional Access you can't have a 100% accurate report.

[#6]

Has anyone resolved this? Aldin, did you just accept having to manually look through everyone's account to see if MFA was enabled? Did you convert your users to an older, but seemingly better MFA setup (per-user)? Does anyone in Microsoft have a resolution to this or a reason for this, since this is the preferred Microsoft MFA method??? This is frustratingly ridiculous.

[#7]

@justJustinian 
So far I've seen 2 methods used.

1. You can report on the MFA registration type, so if you have simple conditional access policies you may be able to assume coverage if they are registered.
2. I've seen some third party tools actually parse the login audit logs and report on any logins without MFA.

But no, nothing direct from MS.

[#8]

@justJustinian 

The way I have resolved this is by creating a Dynamic Azure AD Group that adds all users eligible for MFA via Conditional Access (e.g. having the correct license assigned).

Then scoped the Conditional Access policy to that group.

Then, for the inventory, I have Powershell script using MsGraph that will chcek to see if any Authentication Method exists for all users and what method it is.

In the same script, I cross-reference these users with the Azure AD Group membership for the group that's scoped for Conditional License).

If user has an Authentication Method configured and is member of the group, MFA is enabled and enforced.

If user has an Authentication Method configured and not a member of the group, MFA is not enforced.

If user does not have an Authentication Method configured but is a member of the group, MFA is enabled but not yet enforced (e.g. user didn't enroll yet).

If user is not a member of the group, MFA is disabled.

Now this all sounds too much. And it is.

It's unbelievable that we have to do all of this to be able to report on such a basic feature.

But I really didn't see any other way to have a reliable inventory in our environment for MFA.

I would share the script, but it's really fully customized for our own environment and it wouldn't be usefull for you.

It does a complete inventory of all users, guests, licenses, last login, mfa, etc...

But as I've said... it's specific to our environment and it would be useless to share it with anyone.

The MFA part is loosely based on this script:

powershell-scripts/GetMFAStatusReport.ps1 at master · admindroid-community/powershell-scripts · GitH...

I took snippets of that script because it's very well written.

But if you use it as is, and add a few lines to get AAD Group membership, you would have the same.

[#9]

I appreciate everyone's feedback. Now to get better built-in reporting, but this is great, thank you!

[#10]

@NidalT 

I've been using this script for a while but only this week realised that the reporting was incorrect.

I've just edited the script to be more accurate in a generic way.  Hopefully this helps others.

Where the script originally 'checked' for Conditional Access, I replaced this

$MFAStatus='Enabled via Conditional Access'

With this

   $mfaPolicies = Get-AzureADMSConditionalAccessPolicy | Where {$_.GrantControls.BuiltInControls -contains "Mfa"}
   $aadUser = Get-AzureADUser -ObjectId $Upn
   $userObjectId = $aadUser.ObjectId
   $userMembership = ($aadUser | Get-AzureADUserMembership).ObjectId
   if (!$userMembership) {
     $userMembership = ""
   }
   if ($mfaPolicies | Where {
     $_.Conditions.Users.IncludeUsers -eq "All" -or `
     $_.Conditions.Users.IncludeUsers -contains $aadUser.ObjectId -or `
     (Compare-Object -ReferenceObject $_.Conditions.Users.IncludeGroups -DifferenceObject $userMembership -IncludeEqual -ErrorAction SilentlyContinue).SideIndicator -contains "==" -or `
     (Compare-Object -ReferenceObject $_.Conditions.Users.IncludeRoles -DifferenceObject $userMembership -IncludeEqual -ErrorAction SilentlyContinue).SideIndicator -contains "==" -and `
     $_.Conditions.Users.ExcludeUsers -notcontains $aadUser.ObjectId -or `
     (Compare-Object -ReferenceObject $_.Conditions.Users.ExcludeGroups -DifferenceObject $userMembership -IncludeEqual -ErrorAction SilentlyContinue).SideIndicator -contains "==" -or `
     (Compare-Object -ReferenceObject $_.Conditions.Users.ExcludeRoles -DifferenceObject $userMembership -IncludeEqual -ErrorAction SilentlyContinue).SideIndicator -contains "==" -and `
     $_.State -eq "enabled"
   }) {
    $MFAStatus="Enabled via Conditional Access"
  } else {
     $MFAStatus="Disabled"
   }

All it really does is get the current users ObjectID, get the ObjectID of all the roles and groups to which the user is assigned and then checks the conditional access policies which are configured for MFA to see if the user belongs to them, is not excluded from them, and the policy is enabled.

I had to use the AzureAD module to do this so I also have to authenticate with that module so I had to update the part of the script which connects to MSOnline to also connect to Azure AD by replacing this

if(($UserName -ne "") -and ($Password -ne ""))
{
 $SecuredPassword = ConvertTo-SecureString -AsPlainText $Password -Force
 $Credential  = New-Object System.Management.Automation.PSCredential $UserName,$SecuredPassword
 Connect-MsolService -Credential $credential
}
else
{
 Connect-MsolService | Out-Null
}

With this

if(($UserName -ne "") -and ($Password -ne ""))
{
 $SecuredPassword = ConvertTo-SecureString -AsPlainText $Password -Force
 $Credential  = New-Object System.Management.Automation.PSCredential $UserName,$SecuredPassword
 Connect-MsolService -Credential $credential
 Connect-AzureAD -Credential $credential
}
else
{
 Write-Host "You will be prompted to sign-in twice, once to Microsoft 365 and then for Azure AD!" -ForegroundColor Yellow
 Connect-MsolService | Out-Null
 Connect-AzureAD | Out-Null
}

The issue seems to be that the script writer assumed that not explicitly enabling/enforcing MFA for a user meant that it was "Enabled via Conditional Access" and hard coded that value.  This should have been "Controlled via Conditional Access", but it never meant a policy was actually applied.

UPADTE: These changes do cause the script to throw errors when a user is not a member of any roles/groups.  They are nothing to worry about and the script is still accurate according to my testing.  I'll try and figure out how to suppress them without making it really complicated.

UPDATE: Added a quick if statement to check if `$userMembership` is null, if it is then it's created as a blank variable which doesn't result in an error for the `compare-object`.

[#11]

This is gold!
I didn't think of doing it that way. It makes much more sense!

Thank you!
I'll review my script and update it with your part.

[#12]

No worries.
It feels like it should have been much more straight forward. But once I got my head around what values were available and where, it wasn't too bad.

[#13]

@NidalT 

Another flaw with the admindroid script is that it only report the admin status for users who are actively assigned admin roles.  If users are eligible for use through PIM, it does not recognise them as admin accounts.

This will require use of the AzureADPreview module by the looks of it.  I am not opening that can of worms today.

[#14]

any chance I can download that script ty @SimonBrown