Report on MFA Status with Conditional Access

NidalT 

I've been using this script for a while but only this week realised that the reporting was incorrect.

I've just edited the script to be more accurate in a generic way.  Hopefully this helps others.

Where the script originally 'checked' for Conditional Access, I replaced this

$MFAStatus='Enabled via Conditional Access'

With this

   $mfaPolicies = Get-AzureADMSConditionalAccessPolicy | Where {$_.GrantControls.BuiltInControls -contains "Mfa"}
   $aadUser = Get-AzureADUser -ObjectId $Upn
   $userObjectId = $aadUser.ObjectId
   $userMembership = ($aadUser | Get-AzureADUserMembership).ObjectId
   if (!$userMembership) {
     $userMembership = ""
   }
   if ($mfaPolicies | Where {
     $_.Conditions.Users.IncludeUsers -eq "All" -or `
     $_.Conditions.Users.IncludeUsers -contains $aadUser.ObjectId -or `
     (Compare-Object -ReferenceObject $_.Conditions.Users.IncludeGroups -DifferenceObject $userMembership -IncludeEqual -ErrorAction SilentlyContinue).SideIndicator -contains "==" -or `
     (Compare-Object -ReferenceObject $_.Conditions.Users.IncludeRoles -DifferenceObject $userMembership -IncludeEqual -ErrorAction SilentlyContinue).SideIndicator -contains "==" -and `
     $_.Conditions.Users.ExcludeUsers -notcontains $aadUser.ObjectId -or `
     (Compare-Object -ReferenceObject $_.Conditions.Users.ExcludeGroups -DifferenceObject $userMembership -IncludeEqual -ErrorAction SilentlyContinue).SideIndicator -contains "==" -or `
     (Compare-Object -ReferenceObject $_.Conditions.Users.ExcludeRoles -DifferenceObject $userMembership -IncludeEqual -ErrorAction SilentlyContinue).SideIndicator -contains "==" -and `
     $_.State -eq "enabled"
   }) {
    $MFAStatus="Enabled via Conditional Access"
  } else {
     $MFAStatus="Disabled"
   }

All it really does is get the current users ObjectID, get the ObjectID of all the roles and groups to which the user is assigned and then checks the conditional access policies which are configured for MFA to see if the user belongs to them, is not excluded from them, and the policy is enabled.

I had to use the AzureAD module to do this so I also have to authenticate with that module so I had to update the part of the script which connects to MSOnline to also connect to Azure AD by replacing this

if(($UserName -ne "") -and ($Password -ne ""))
{
 $SecuredPassword = ConvertTo-SecureString -AsPlainText $Password -Force
 $Credential  = New-Object System.Management.Automation.PSCredential $UserName,$SecuredPassword
 Connect-MsolService -Credential $credential
}
else
{
 Connect-MsolService | Out-Null
}

With this

if(($UserName -ne "") -and ($Password -ne ""))
{
 $SecuredPassword = ConvertTo-SecureString -AsPlainText $Password -Force
 $Credential  = New-Object System.Management.Automation.PSCredential $UserName,$SecuredPassword
 Connect-MsolService -Credential $credential
 Connect-AzureAD -Credential $credential
}
else
{
 Write-Host "You will be prompted to sign-in twice, once to Microsoft 365 and then for Azure AD!" -ForegroundColor Yellow
 Connect-MsolService | Out-Null
 Connect-AzureAD | Out-Null
}

The issue seems to be that the script writer assumed that not explicitly enabling/enforcing MFA for a user meant that it was "Enabled via Conditional Access" and hard coded that value.  This should have been "Controlled via Conditional Access", but it never meant a policy was actually applied.

UPADTE: These changes do cause the script to throw errors when a user is not a member of any roles/groups.  They are nothing to worry about and the script is still accurate according to my testing.  I'll try and figure out how to suppress them without making it really complicated.

UPDATE: Added a quick if statement to check if `$userMembership` is null, if it is then it's created as a blank variable which doesn't result in an error for the `compare-object`.