Security governance has been top of mind for most since the onslaught of human malware has the masses working from home. This comes with new concerns surrounding identity protection and actually proving that remote users are who they say they are in order to be allowed access to organizational data. Multi-factor Authentication (MFA) is a great tool to ensure this however the task of knowing which user has it enabled can be tedious.
Enter PowerShell to the rescue to automate reporting of this process.
The following script will report on your organizations MFA status per user and report on which users are admins. The latter being even more crucial that MFA is enabled.
Function Get-AzureMFAStatus {
[CmdletBinding()]
param(
[Parameter(
Position=0,
ValueFromPipeline=$true,
ValueFromPipelineByPropertyName=$true
)]
[string[]] $UserPrincipalName,
[int] $MaxResults = 4000,
[bool] $isLicensed = $true,
[switch] $SkipAdminCheck
)
BEGIN {
if ($SkipAdminCheck.IsPresent) {
$AdminUsers = Get-MsolRole -ErrorAction Stop | foreach {Get-MsolRoleMember -RoleObjectId $_.ObjectID} | Where-Object {$_.EmailAddress -ne $null} | Select EmailAddress -Unique | Sort-Object EmailAddress
}
}
PROCESS {
if ($UserPrincipalName) {
foreach ($User in $UserPrincipalName) {
try {
Get-MsolUser -UserPrincipalName $User -ErrorAction Stop | select DisplayName, UserPrincipalName, `
@{Name = 'isAdmin'; Expression = {if ($SkipAdminCheck) {Write-Output "-"} else {if ($AdminUsers -match $_.UserPrincipalName) {Write-Output $true} else {Write-Output $false}}}}, `
@{Name = 'MFAEnabled'; Expression={if ($_.StrongAuthenticationMethods) {Write-Output $true} else {Write-Output $false}}}
} catch {
$Object = [pscustomobject]@{
DisplayName = '_NotSynced'
UserPrincipalName = $User
isAdmin = '-'
MFAEnabled = '-'
}
Write-Output $Object
}
}
} else {
$AllUsers = Get-MsolUser -MaxResults $MaxResults | Where-Object {$_.IsLicensed -eq $isLicensed} | select DisplayName, UserPrincipalName, `
@{Name = 'isAdmin'; Expression = {if ($SkipAdminCheck) {Write-Output "-"} else {if ($AdminUsers -match $_.UserPrincipalName) {Write-Output $true} else {Write-Output $false}}}}, `
@{Name = 'MFAEnabled'; Expression={if ($_.StrongAuthenticationMethods) {Write-Output $true} else {Write-Output $false}}}
Write-Output $AllUsers | Sort-Object isAdmin, MFAEnabled -Descending
}
}
END {}
}
As always, please share your comments below on bettering the above script or any questions you may have.
