Nov 11 2020
05:56 AM
- last edited on
Jan 14 2022
04:27 PM
by
TechCommunityAP
Nov 11 2020
05:56 AM
- last edited on
Jan 14 2022
04:27 PM
by
TechCommunityAP
How can I view and unblock uses that have become blocked using MFA in Powershell
The following
Provides a listing of uses that have become blocked using MFA. In my case, most of the uses listed are a consequence of badly managed MFA registration. But what I really need is to be able to view the listing in Powershell, and potentially unblock the user in Powershell. If unblocking is not possible then viewing would be a start. Perhaps a REST call to the GRAPH API? Anything would help..
//A
Nov 11 2020 08:17 AM
I'm not aware of any way to do this programmatically, but others might prove me wrong :)
Nov 11 2020 12:13 PM
@Vasil Michev I hope they do!
Apr 14 2021 08:07 AM
Jan 27 2022 03:37 PM
Apr 13 2022 05:41 AM
@Compulinx
Hello, can i have more information regarding your last message ?
Thanks a lot
Nov 23 2022 06:04 AM - edited Nov 24 2022 01:00 AM
@AloisPommerais
Not sure how far you got on this, but this is what i have done in the sense of get the blocked accounts, based on the feedback from @Compulinx above.
Import-Module Microsoft.Graph.Reports
Connect-Graph -Scopes "AuditLog.Read.All" -TenantId "{TENANT_ID}"
$Filter = "activityDisplayName eq 'Fraud reported - user is blocked for MFA'"
Get-MgAuditLogDirectoryAudit -Filter $Filter | Select -ExpandProperty TargetResources
So now i can see that something/Someone have reported fraud, next step is how to unblock.
Hope that help others on the way, please revert if you have a way of showing who it is and how to unblock.