Bankesy Posted March 23, 2023 Posted March 23, 2023 Good afternoon, Having recently gone through the process of creating conditional access polices for combined security information registration and MFA for Office 365 I would like to check who has and who hasn't set this up. When I check this through Admin Centre>Active Users>Multi-factor authentication I just get a list of all users with Multi-Factor Auth status marked as Disabled but I know users have registered. Am I checking this is the wrong place or are my users not really registered? Thanks
DavR Posted March 23, 2023 Posted March 23, 2023 I'm not aware of there being a report that shows which users have or haven't signed up to MFA, but, if you go into Azure Portal and look at the users through there, it will show who has a phone number registered to their account (assuming you haven't pre-filled this yourself, and that phone number is the primary MFA you're using).
DavR Posted March 23, 2023 Posted March 23, 2023 When I check this through Admin Centre>Active Users>Multi-factor authentication I just get a list of all users with Multi-Factor Auth status marked as Disabled but I know users have registered. My understanding is that, when you use Conditional Access MFA policies, this page gets overridden. It's normal to see these saying disabled, even though they are covered by Conditional MFA.
TechMonkey Posted March 23, 2023 Posted March 23, 2023 @DaveAshworth is correct, that page is redundant once conditional access is used. I thought MS were removing it, but that may have been delayed or just it needs to be removed. I have had great success using HFA Status script from this page https://lazyadmin.nl/powershell/list-office365-mfa-status-powershell/ 1
DavR Posted March 23, 2023 Posted March 23, 2023 (edited) @DaveAshworth is correct, that page is redundant once conditional access is used. I thought MS were removing it, but that may have been delayed or just it needs to be removed. Unless they replace it with something else, it is still relevant for those not using conditional MFA. I was using it right up til recently when I created our conditional access policies. We didn't have the licensing for conditional until very recently. Agreed though - it's very confusing essentially running two different MFA systems! Edited March 23, 2023 by DavR
howartp Posted March 23, 2023 Posted March 23, 2023 https://portal.azure.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/UserRegistrationDetails/menuId/AuthMethodsActivity (Azure > AD > Usage & Insights > Authentication Methods Activity > User Registration Details) That shows you who has registered/not registered 2FA methods. 2
Bankesy Posted March 24, 2023 Author Posted March 24, 2023 Thanks everyone, while we are on the subject does anybody have any advice as to how the conditional access policy should be setup to prompt for 2FA when using sites or services that utilise SSO. At the moment I've only added Office 365 as an app that requires 2FA but I gather this doesn't cover anything that utilises 'Login with Microsoft' Is it just a case of point at 'All Cloud Apps'? Thanks
TechMonkey Posted March 24, 2023 Posted March 24, 2023 Yep, all cloud apps will ask for anything. I also put a conditional access rule to only allow MFA to be setup on site, to stop malicious setup if someone hadn't used their account.
Bankesy Posted March 24, 2023 Author Posted March 24, 2023 @TechMonkey I put a conditional access rule to only allow combined security info registration to be setup on site, same thing right?
CTIDTech Posted March 24, 2023 Posted March 24, 2023 We used ClassLink for SSO for all our schools - All of our accessible programmes (apps links etc) now 'live' behind an MFA wall both for students and staff so we ticked that box. We don't implement conditional as it's just one log in to everything! Seems to keep everyone happy and works for all MS/other products which don't support MS login! Even the catering staff use it to access their f&b ordering supplier site.
nicholab Posted March 24, 2023 Posted March 24, 2023 You should be able query this in log analytics/sentinel. There are open source work books that can be used in sentinel.
ultima170387 Posted March 27, 2023 Posted March 27, 2023 @TechMonkey I put a conditional access rule to only allow combined security info registration to be setup on site, same thing right? Would you mind sharing how you set this up please? Or point to any guides you know of.
Bankesy Posted March 28, 2023 Author Posted March 28, 2023 @ultima170387 I will come back to you on that, currently troubleshooting a corrupt Exchange database that won't mount 1
TechMonkey Posted April 6, 2023 Posted April 6, 2023 Would you mind sharing how you set this up please? Or point to any guides you know of. Got to Azure Portal and select "Manage Azure Active Directory. In the bar on the left choose "Security" Under "Protect" on the left choose "Conditional Access" Along the top bar choose "New policy from template (Preview)" Choose the "Securing security info registration" tile then click "Next: Review + Create" at the bottom Click "Create" along the bottom That should be it as long as you have trusted locations setup. If you don't you need to go in and set the school external IP as an exclusion. I'd recommend setting up trusted locations as it makes it a lot easier to reference in multiple places. Hope that helps.
Bankesy Posted April 6, 2023 Author Posted April 6, 2023 @cheekycharly Yeah it was but I had started another thread on the forum about all of that and people came to my aid so it's all working now. Next challenge...working out why multi-factor is preventing some users (not all) from accessing SSO resources such as EduLink etc.
Bankesy Posted April 6, 2023 Author Posted April 6, 2023 @TechMonkey I didn't quite do it the way you have described, I did it manually following this link: https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-registration-mfa-sspr-combined This is what I advised to @ultima170387 but now I'm thinking your way is better apart from the bit where it includes all users but I guess this can be edited after? Now I'm wondering if you have any tips for configuring multi-factor authentication itself as in when it's required\what it's required for? Did you use the 'Require multifactor authentication for all users' template for this as well? Again though I'm trying to configure for only staff and only outside of the network. Thanks
TechMonkey Posted April 6, 2023 Posted April 6, 2023 @TechMonkey I didn't quite do it the way you have described, I did it manually following this link: https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-registration-mfa-sspr-combined This is what I advised to @ultima170387 but now I'm thinking your way is better apart from the bit where it includes all users but I guess this can be edited after? Now I'm wondering if you have any tips for configuring multi-factor authentication itself as in when it's required\what it's required for? Did you use the 'Require multifactor authentication for all users' template for this as well? Again though I'm trying to configure for only staff and only outside of the network. Thanks When I set them up there weren't any templates so I did it manually as well, just seemed easier to go through the template. The template is a good start and then customising it would be the way to go. You can set an exclusion for trusted locations and either only include certain user groups, or exclude pupil groups.
Oaktech Posted April 6, 2023 Posted April 6, 2023 Not my script (LazyAdmin.nl), but works beautifully... usage: .\getmfa.ps1 | export-csv c:\temp\downloadsmfastatus.csv <# .Synopsis Get the MFA status for all users or a single user. .DESCRIPTION This script will get the Azure MFA Status for your users. You can query all the users, admins only or a single user. It will return the MFA Status, MFA type ( .NOTES Name: Get-MFAStatus Author: R. Mens - LazyAdmin.nl Version: 1.3 DateCreated: jan 2021 Purpose/Change: List all Configured MFA Types Thanks to: Anthony Bartolo .LINK [url]https://lazyadmin.nl[/url] .EXAMPLE Get-MFAStatus Get the MFA Status of all enabled and licensed users and check if there are an admin or not .EXAMPLE Get-MFAStatus -UserPrincipalName '[email protected]','[email protected]' Get the MFA Status for the users John Doe and Jane Doe .EXAMPLE Get-MFAStatus -withOutMFAOnly Get only the licensed and enabled users that don't have MFA enabled .EXAMPLE Get-MFAStatus -adminsOnly Get the MFA Status of the admins only .EXAMPLE Get-MsolUser -Country "NL" | ForEach-Object { Get-MFAStatus -UserPrincipalName $_.UserPrincipalName } Get the MFA status for all users in the Country The Netherlands. You can use a similar approach to run this for a department only. .EXAMPLE Get-MFAStatus -withOutMFAOnly | Export-CSV c:\temp\userwithoutmfa.csv -noTypeInformation Get all users without MFA and export them to a CSV file #> [CmdletBinding(DefaultParameterSetName="Default")] param( [Parameter( Mandatory = $false, ParameterSetName = "UserPrincipalName", HelpMessage = "Enter a single UserPrincipalName or a comma separted list of UserPrincipalNames", Position = 0 )] [string[]]$UserPrincipalName, [Parameter( Mandatory = $false, ValueFromPipeline = $false, ParameterSetName = "AdminsOnly" )] # Get only the users that are an admin [switch]$adminsOnly = $false, [Parameter( Mandatory = $false, ValueFromPipeline = $false, ParameterSetName = "AllUsers" )] # Set the Max results to return [int]$MaxResults = 10000, [Parameter( Mandatory = $false, ValueFromPipeline = $false, ParameterSetName = "Licenend" )] # Check only the MFA status of users that have license [switch]$IsLicensed = $true, [Parameter( Mandatory = $false, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = "withOutMFAOnly" )] # Get only the users that don't have MFA enabled [switch]$withOutMFAOnly = $false, [Parameter( Mandatory = $false, ValueFromPipeline = $false )] # Check if a user is an admin. Set to $false to skip the check [switch]$listAdmins = $true ) # Connect to Msol if ((Get-Module -ListAvailable -Name MSOnline) -eq $null) { Write-Host "MSOnline Module is required, do you want to install it?" -ForegroundColor Yellow $install = Read-Host Do you want to install module? [Y] Yes [N] No if($install -match "[yY]") { Write-Host "Installing MSOnline module" -ForegroundColor Cyan Install-Module MSOnline -Repository PSGallery -AllowClobber -Force } else { Write-Error "Please install MSOnline module." } } if ((Get-Module -ListAvailable -Name MSOnline) -ne $null) { if(-not (Get-MsolDomain -ErrorAction SilentlyContinue)) { Connect-MsolService } } else{ Write-Error "Please install Msol module." } # Get all licensed admins $admins = $null if (($listAdmins) -or ($adminsOnly)) { $admins = Get-MsolRole | %{$role = $_.name; Get-MsolRoleMember -RoleObjectId $_.objectid} | Where-Object {$_.isLicensed -eq $true} | select @{Name="Role"; Expression = {$role}}, DisplayName, EmailAddress, ObjectId | Sort-Object -Property EmailAddress -Unique } # Check if a UserPrincipalName is given # Get the MFA status for the given user(s) if they exist if ($PSBoundParameters.ContainsKey('UserPrincipalName')) { foreach ($user in $UserPrincipalName) { try { $MsolUser = Get-MsolUser -UserPrincipalName $user -ErrorAction Stop $Method = "" $MFAMethod = $MsolUser.StrongAuthenticationMethods | Where-Object {$_.IsDefault -eq $true} | Select-Object -ExpandProperty MethodType If (($MsolUser.StrongAuthenticationRequirements) -or ($MsolUser.StrongAuthenticationMethods)) { Switch ($MFAMethod) { "OneWaySMS" { $Method = "SMS token" } "TwoWayVoiceMobile" { $Method = "Phone call verification" } "PhoneAppOTP" { $Method = "Hardware token or authenticator app" } "PhoneAppNotification" { $Method = "Authenticator app" } } } [PSCustomObject]@{ DisplayName = $MsolUser.DisplayName UserPrincipalName = $MsolUser.UserPrincipalName isAdmin = if ($listAdmins -and $admins.EmailAddress -match $MsolUser.UserPrincipalName) {$true} else {"-"} MFAEnabled = if ($MsolUser.StrongAuthenticationMethods) {$true} else {$false} MFAType = $Method MFAEnforced = if ($MsolUser.StrongAuthenticationRequirements) {$true} else {"-"} } } catch { [PSCustomObject]@{ DisplayName = " - Not found" UserPrincipalName = $User isAdmin = $null MFAEnabled = $null } } } } # Get only the admins and check their MFA Status elseif ($adminsOnly) { foreach ($admin in $admins) { $MsolUser = Get-MsolUser -ObjectId $admin.ObjectId | Sort-Object UserPrincipalName -ErrorAction Stop $MFAMethod = $MsolUser.StrongAuthenticationMethods | Where-Object {$_.IsDefault -eq $true} | Select-Object -ExpandProperty MethodType $Method = "" If (($MsolUser.StrongAuthenticationRequirements) -or ($MsolUser.StrongAuthenticationMethods)) { Switch ($MFAMethod) { "OneWaySMS" { $Method = "SMS token" } "TwoWayVoiceMobile" { $Method = "Phone call verification" } "PhoneAppOTP" { $Method = "Hardware token or authenticator app" } "PhoneAppNotification" { $Method = "Authenticator app" } } } [PSCustomObject]@{ DisplayName = $MsolUser.DisplayName UserPrincipalName = $MsolUser.UserPrincipalName isAdmin = $true "MFA Enabled" = if ($MsolUser.StrongAuthenticationMethods) {$true} else {$false} "MFA Default Type"= $Method "SMS token" = if ($MsolUser.StrongAuthenticationMethods.MethodType -contains "OneWaySMS") {$true} else {"-"} "Phone call verification" = if ($MsolUser.StrongAuthenticationMethods.MethodType -contains "TwoWayVoiceMobile") {$true} else {"-"} "Hardware token or authenticator app" = if ($MsolUser.StrongAuthenticationMethods.MethodType -contains "PhoneAppOTP") {$true} else {"-"} "Authenticator app" = if ($MsolUser.StrongAuthenticationMethods.MethodType -contains "PhoneAppNotification") {$true} else {"-"} MFAEnforced = if ($MsolUser.StrongAuthenticationRequirements) {$true} else {"-"} } } } # Get the MFA status from all the users else { $MsolUsers = Get-MsolUser -EnabledFilter EnabledOnly -MaxResults $MaxResults | Where-Object {$_.IsLicensed -eq $isLicensed} | Sort-Object UserPrincipalName foreach ($MsolUser in $MsolUsers) { $MFAMethod = $MsolUser.StrongAuthenticationMethods | Where-Object {$_.IsDefault -eq $true} | Select-Object -ExpandProperty MethodType $Method = "" If (($MsolUser.StrongAuthenticationRequirements) -or ($MsolUser.StrongAuthenticationMethods)) { Switch ($MFAMethod) { "OneWaySMS" { $Method = "SMS token" } "TwoWayVoiceMobile" { $Method = "Phone call verification" } "PhoneAppOTP" { $Method = "Hardware token or authenticator app" } "PhoneAppNotification" { $Method = "Authenticator app" } } } if ($withOutMFAOnly) { # List only the user that don't have MFA enabled if (-not($MsolUser.StrongAuthenticationMethods)) { [PSCustomObject]@{ DisplayName = $MsolUser.DisplayName UserPrincipalName = $MsolUser.UserPrincipalName isAdmin = if ($listAdmins -and ($admins.EmailAddress -match $MsolUser.UserPrincipalName)) {$true} else {"-"} MFAEnabled = $false MFAType = "-" MFAEnforced = if ($MsolUser.StrongAuthenticationRequirements) {$true} else {"-"} } } }else{ [PSCustomObject]@{ DisplayName = $MsolUser.DisplayName UserPrincipalName = $MsolUser.UserPrincipalName isAdmin = if ($listAdmins -and ($admins.EmailAddress -match $MsolUser.UserPrincipalName)) {$true} else {"-"} "MFA Enabled" = if ($MsolUser.StrongAuthenticationMethods) {$true} else {$false} "MFA Default Type"= $Method "SMS token" = if ($MsolUser.StrongAuthenticationMethods.MethodType -contains "OneWaySMS") {$true} else {"-"} "Phone call verification" = if ($MsolUser.StrongAuthenticationMethods.MethodType -contains "TwoWayVoiceMobile") {$true} else {"-"} "Hardware token or authenticator app" = if ($MsolUser.StrongAuthenticationMethods.MethodType -contains "PhoneAppOTP") {$true} else {"-"} "Authenticator app" = if ($MsolUser.StrongAuthenticationMethods.MethodType -contains "PhoneAppNotification") {$true} else {"-"} MFAEnforced = if ($MsolUser.StrongAuthenticationRequirements) {$true} else {"-"} } } } }
Bankesy Posted April 17, 2023 Author Posted April 17, 2023 Thanks @Oaktech Used that script and it worked well. Now trying to figure out why one user in particular is prompted for multi-factor authentication setup when added to the targeted security group but then told they don't have access after the 'More information required' screen. It's almost like the conditional access policy is both allowing and denying the user to register...?
cheekycharly Posted April 19, 2023 Posted April 19, 2023 So am I reading this correct you guys have multiple policies in place pointing at groups? I envisioned I would just have two policies... 1 "Pupil Conditional Access" (Users Pupils group included, excluded any tenant admins and staff, Conditions>Locations 3 School IP's Excluded and everywhere else blocked) 2 "Staff Conditional Access" (Users Staff group included,excluded any tenant admins and pupils, Conditions>Locations 3 School IP's Excluded and anywhere else in the UK allowed as long as they have 2FA when external) with the settings all within those two policies. If anyone is able to show some screen grabs that would be great or point me in the direction I need to go to make those above style policies.
Bankesy Posted April 19, 2023 Author Posted April 19, 2023 (edited) @cheekycharly Are you asking about the polices to get users to register for SSPR and MFA (combined security info registration) or the polices to dictate when and where users will be prompted for MFA after registering? I'm only doing staff so I have one policy prompting staff to register (inside the network only) and then a separate policy that states users will be prompted for all cloud apps (outside of the network only). Edited April 19, 2023 by Bankesy
cheekycharly Posted April 20, 2023 Posted April 20, 2023 (edited) From reading your reply it seems you make multiple different policies and assign them to the specific groups to make this work. I will need to set it up so there is no MFA prompt for pupils to I will be exempting the IP's of the schools and the same for staff but staff are allowed to access the system externally as long as they MFA. Edited April 20, 2023 by cheekycharly
Bankesy Posted April 20, 2023 Author Posted April 20, 2023 @cheekycharly Yes one policy for registering, setup exactly as per following link but targeted at staff group only: https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-registration-mfa-sspr-combined This doesn't enable SSPR though, you have to switch that on elsewhere in Azure Portal first. Then a separate policy for MFA, still targeted at staff group, excluding trusted location, for all cloud apps. Or alternatively as @TechMonkey points out there are templates to get you started. Happy to continue discussing if you need.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now