Multi-Factor Authentication - Enabled Check

Bankesy · March 23, 2023

Good afternoon,

Having recently gone through the process of creating conditional access polices for combined security information registration and MFA for Office 365 I would like to check who has and who hasn't set this up.

When I check this through Admin Centre>Active Users>Multi-factor authentication I just get a list of all users with Multi-Factor Auth status marked as Disabled but I know users have registered.

Am I checking this is the wrong place or are my users not really registered?

Thanks

DavR · March 23, 2023

I'm not aware of there being a report that shows which users have or haven't signed up to MFA, but, if you go into Azure Portal and look at the users through there, it will show who has a phone number registered to their account (assuming you haven't pre-filled this yourself, and that phone number is the primary MFA you're using).

DavR · March 23, 2023

When I check this through Admin Centre>Active Users>Multi-factor authentication I just get a list of all users with Multi-Factor Auth status marked as Disabled but I know users have registered.

My understanding is that, when you use Conditional Access MFA policies, this page gets overridden. It's normal to see these saying disabled, even though they are covered by Conditional MFA.

TechMonkey · March 23, 2023

@DaveAshworth is correct, that page is redundant once conditional access is used. I thought MS were removing it, but that may have been delayed or just it needs to be removed.

I have had great success using HFA Status script from this page https://lazyadmin.nl/powershell/list-office365-mfa-status-powershell/

DavR · March 23, 2023

@DaveAshworth is correct, that page is redundant once conditional access is used. I thought MS were removing it, but that may have been delayed or just it needs to be removed.

Unless they replace it with something else, it is still relevant for those not using conditional MFA.

I was using it right up til recently when I created our conditional access policies. We didn't have the licensing for conditional until very recently.

Agreed though - it's very confusing essentially running two different MFA systems!

Edited March 23, 2023 by DavR

howartp · March 23, 2023

https://portal.azure.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/UserRegistrationDetails/menuId/AuthMethodsActivity

(Azure > AD > Usage & Insights > Authentication Methods Activity > User Registration Details)

That shows you who has registered/not registered 2FA methods.

Bankesy · March 24, 2023

Thanks everyone, while we are on the subject does anybody have any advice as to how the conditional access policy should be setup to prompt for 2FA when using sites or services that utilise SSO.

At the moment I've only added Office 365 as an app that requires 2FA but I gather this doesn't cover anything that utilises 'Login with Microsoft'

Is it just a case of point at 'All Cloud Apps'?

Thanks

TechMonkey · March 24, 2023

Yep, all cloud apps will ask for anything. I also put a conditional access rule to only allow MFA to be setup on site, to stop malicious setup if someone hadn't used their account.

Bankesy · March 24, 2023

@TechMonkey I put a conditional access rule to only allow combined security info registration to be setup on site, same thing right?

TechMonkey · March 24, 2023

That's the one.

CTIDTech · March 24, 2023

We used ClassLink for SSO for all our schools - All of our accessible programmes (apps links etc) now 'live' behind an MFA wall both for students and staff so we ticked that box. We don't implement conditional as it's just one log in to everything! Seems to keep everyone happy and works for all MS/other products which don't support MS login! Even the catering staff use it to access their f&b ordering supplier site.

nicholab · March 24, 2023

You should be able query this in log analytics/sentinel. There are open source work books that can be used in sentinel.

ultima170387 · March 27, 2023

@TechMonkey I put a conditional access rule to only allow combined security info registration to be setup on site, same thing right?

Would you mind sharing how you set this up please? Or point to any guides you know of.

Bankesy · March 28, 2023

@ultima170387

I will come back to you on that, currently troubleshooting a corrupt Exchange database that won't mount

cheekycharly · April 5, 2023

Is it showing dirty?

TechMonkey · April 6, 2023

Would you mind sharing how you set this up please? Or point to any guides you know of.

Got to Azure Portal and select "Manage Azure Active Directory.
In the bar on the left choose "Security"
Under "Protect" on the left choose "Conditional Access"
Along the top bar choose "New policy from template (Preview)"
Choose the "Securing security info registration" tile then click "Next: Review + Create" at the bottom
Click "Create" along the bottom

That should be it as long as you have trusted locations setup. If you don't you need to go in and set the school external IP as an exclusion. I'd recommend setting up trusted locations as it makes it a lot easier to reference in multiple places.

Hope that helps.

Bankesy · April 6, 2023

@cheekycharly

Yeah it was but I had started another thread on the forum about all of that and people came to my aid so it's all working now.

Next challenge...working out why multi-factor is preventing some users (not all) from accessing SSO resources such as EduLink etc.

Bankesy · April 6, 2023

@TechMonkey

I didn't quite do it the way you have described, I did it manually following this link:

https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-registration-mfa-sspr-combined

This is what I advised to @ultima170387 but now I'm thinking your way is better apart from the bit where it includes all users but I guess this can be edited after?

Now I'm wondering if you have any tips for configuring multi-factor authentication itself as in when it's required\what it's required for? Did you use the 'Require multifactor authentication for all users' template for this as well?

Again though I'm trying to configure for only staff and only outside of the network.

Thanks

TechMonkey · April 6, 2023

@TechMonkey

I didn't quite do it the way you have described, I did it manually following this link:

https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-registration-mfa-sspr-combined

This is what I advised to @ultima170387 but now I'm thinking your way is better apart from the bit where it includes all users but I guess this can be edited after?

Now I'm wondering if you have any tips for configuring multi-factor authentication itself as in when it's required\what it's required for? Did you use the 'Require multifactor authentication for all users' template for this as well?

Again though I'm trying to configure for only staff and only outside of the network.

Thanks

When I set them up there weren't any templates so I did it manually as well, just seemed easier to go through the template. The template is a good start and then customising it would be the way to go. You can set an exclusion for trusted locations and either only include certain user groups, or exclude pupil groups.

Oaktech · April 6, 2023

Not my script (LazyAdmin.nl), but works beautifully...

usage: .\getmfa.ps1 | export-csv c:\temp\downloadsmfastatus.csv

<#
.Synopsis
 Get the MFA status for all users or a single user.

.DESCRIPTION
 This script will get the Azure MFA Status for your users. You can query all the users, admins only or a single user.
  
 It will return the MFA Status, MFA type (

.NOTES
 Name: Get-MFAStatus
 Author: R. Mens - LazyAdmin.nl
 Version: 1.3
 DateCreated: jan 2021
 Purpose/Change: List all Configured MFA Types
 Thanks to: Anthony Bartolo

.LINK
 [url]https://lazyadmin.nl[/url]

.EXAMPLE
 Get-MFAStatus

 Get the MFA Status of all enabled and licensed users and check if there are an admin or not

.EXAMPLE
 Get-MFAStatus -UserPrincipalName '[email protected]','[email protected]'

 Get the MFA Status for the users John Doe and Jane Doe

.EXAMPLE
 Get-MFAStatus -withOutMFAOnly

 Get only the licensed and enabled users that don't have MFA enabled

.EXAMPLE
 Get-MFAStatus -adminsOnly

 Get the MFA Status of the admins only

.EXAMPLE
 Get-MsolUser -Country "NL" | ForEach-Object { Get-MFAStatus -UserPrincipalName $_.UserPrincipalName }

 Get the MFA status for all users in the Country The Netherlands. You can use a similar approach to run this
 for a department only.

.EXAMPLE
 Get-MFAStatus -withOutMFAOnly | Export-CSV c:\temp\userwithoutmfa.csv -noTypeInformation

 Get all users without MFA and export them to a CSV file
#>
[CmdletBinding(DefaultParameterSetName="Default")]
param(
 [Parameter(
   Mandatory = $false,
   ParameterSetName  = "UserPrincipalName",
   HelpMessage = "Enter a single UserPrincipalName or a comma separted list of UserPrincipalNames",
   Position = 0
   )]
 [string[]]$UserPrincipalName,

 [Parameter(
   Mandatory = $false,
   ValueFromPipeline = $false,
   ParameterSetName  = "AdminsOnly"
 )]
 # Get only the users that are an admin
 [switch]$adminsOnly = $false,

 [Parameter(
   Mandatory         = $false,
   ValueFromPipeline = $false,
   ParameterSetName  = "AllUsers"
 )]
 # Set the Max results to return
 [int]$MaxResults = 10000,

 [Parameter(
   Mandatory         = $false,
   ValueFromPipeline = $false,
   ParameterSetName  = "Licenend"
 )]
 # Check only the MFA status of users that have license
 [switch]$IsLicensed = $true,

 [Parameter(
   Mandatory         = $false,
   ValueFromPipeline = $true,
   ValueFromPipelineByPropertyName = $true,
   ParameterSetName  = "withOutMFAOnly"
 )]
 # Get only the users that don't have MFA enabled
 [switch]$withOutMFAOnly = $false,

 [Parameter(
   Mandatory         = $false,
   ValueFromPipeline = $false
 )]
 # Check if a user is an admin. Set to $false to skip the check
 [switch]$listAdmins = $true
)



# Connect to Msol
if ((Get-Module -ListAvailable -Name MSOnline) -eq $null)
{
 Write-Host "MSOnline Module is required, do you want to install it?" -ForegroundColor Yellow
     
 $install = Read-Host Do you want to install module? [Y] Yes [N] No 
 if($install -match "[yY]") 
 { 
   Write-Host "Installing MSOnline module" -ForegroundColor Cyan
   Install-Module MSOnline -Repository PSGallery -AllowClobber -Force
 } 
 else
 {
   Write-Error "Please install MSOnline module."
 }
}

if ((Get-Module -ListAvailable -Name MSOnline) -ne $null) 
{
 if(-not (Get-MsolDomain -ErrorAction SilentlyContinue))
 {
   Connect-MsolService
 }
}
else{
 Write-Error "Please install Msol module."
}
 
# Get all licensed admins
$admins = $null

if (($listAdmins) -or ($adminsOnly)) {
 $admins = Get-MsolRole | %{$role = $_.name; Get-MsolRoleMember -RoleObjectId $_.objectid} | Where-Object {$_.isLicensed -eq $true} | select @{Name="Role"; Expression = {$role}}, DisplayName, EmailAddress, ObjectId | Sort-Object -Property EmailAddress -Unique
}

# Check if a UserPrincipalName is given
# Get the MFA status for the given user(s) if they exist
if ($PSBoundParameters.ContainsKey('UserPrincipalName')) {
 foreach ($user in $UserPrincipalName) {
   try {
     $MsolUser = Get-MsolUser -UserPrincipalName $user -ErrorAction Stop

     $Method = ""
     $MFAMethod = $MsolUser.StrongAuthenticationMethods | Where-Object {$_.IsDefault -eq $true} | Select-Object -ExpandProperty MethodType

     If (($MsolUser.StrongAuthenticationRequirements) -or ($MsolUser.StrongAuthenticationMethods)) {
       Switch ($MFAMethod) {
           "OneWaySMS" { $Method = "SMS token" }
           "TwoWayVoiceMobile" { $Method = "Phone call verification" }
           "PhoneAppOTP" { $Method = "Hardware token or authenticator app" }
           "PhoneAppNotification" { $Method = "Authenticator app" }
       }
     }

     [PSCustomObject]@{
       DisplayName       = $MsolUser.DisplayName
       UserPrincipalName = $MsolUser.UserPrincipalName
       isAdmin           = if ($listAdmins -and $admins.EmailAddress -match $MsolUser.UserPrincipalName) {$true} else {"-"}
       MFAEnabled        = if ($MsolUser.StrongAuthenticationMethods) {$true} else {$false}
       MFAType           = $Method
       MFAEnforced       = if ($MsolUser.StrongAuthenticationRequirements) {$true} else {"-"}
     }
   }
   catch {
     [PSCustomObject]@{
       DisplayName       = " - Not found"
       UserPrincipalName = $User
       isAdmin           = $null
       MFAEnabled        = $null
     }
   }
 }
}
# Get only the admins and check their MFA Status
elseif ($adminsOnly) {
 foreach ($admin in $admins) {
   $MsolUser = Get-MsolUser -ObjectId $admin.ObjectId | Sort-Object UserPrincipalName -ErrorAction Stop

   $MFAMethod = $MsolUser.StrongAuthenticationMethods | Where-Object {$_.IsDefault -eq $true} | Select-Object -ExpandProperty MethodType
   $Method = ""

   If (($MsolUser.StrongAuthenticationRequirements) -or ($MsolUser.StrongAuthenticationMethods)) {
       Switch ($MFAMethod) {
           "OneWaySMS" { $Method = "SMS token" }
           "TwoWayVoiceMobile" { $Method = "Phone call verification" }
           "PhoneAppOTP" { $Method = "Hardware token or authenticator app" }
           "PhoneAppNotification" { $Method = "Authenticator app" }
       }
     }
   
   [PSCustomObject]@{
     DisplayName       = $MsolUser.DisplayName
     UserPrincipalName = $MsolUser.UserPrincipalName
     isAdmin           = $true
     "MFA Enabled"     = if ($MsolUser.StrongAuthenticationMethods) {$true} else {$false}
     "MFA Default Type"= $Method
     "SMS token"       = if ($MsolUser.StrongAuthenticationMethods.MethodType -contains "OneWaySMS") {$true} else {"-"}
     "Phone call verification" = if ($MsolUser.StrongAuthenticationMethods.MethodType -contains "TwoWayVoiceMobile") {$true} else {"-"}
     "Hardware token or authenticator app" = if ($MsolUser.StrongAuthenticationMethods.MethodType -contains "PhoneAppOTP") {$true} else {"-"}
     "Authenticator app" = if ($MsolUser.StrongAuthenticationMethods.MethodType -contains "PhoneAppNotification") {$true} else {"-"}
     MFAEnforced = if ($MsolUser.StrongAuthenticationRequirements) {$true} else {"-"}
   }
 }
}
# Get the MFA status from all the users
else {
 $MsolUsers = Get-MsolUser -EnabledFilter EnabledOnly -MaxResults $MaxResults | Where-Object {$_.IsLicensed -eq $isLicensed} | Sort-Object UserPrincipalName
   foreach ($MsolUser in $MsolUsers) {

     $MFAMethod = $MsolUser.StrongAuthenticationMethods | Where-Object {$_.IsDefault -eq $true} | Select-Object -ExpandProperty MethodType
     $Method = ""

     If (($MsolUser.StrongAuthenticationRequirements) -or ($MsolUser.StrongAuthenticationMethods)) {
       Switch ($MFAMethod) {
           "OneWaySMS" { $Method = "SMS token" }
           "TwoWayVoiceMobile" { $Method = "Phone call verification" }
           "PhoneAppOTP" { $Method = "Hardware token or authenticator app" }
           "PhoneAppNotification" { $Method = "Authenticator app" }
       }
     }

     if ($withOutMFAOnly) {
       # List only the user that don't have MFA enabled
       if (-not($MsolUser.StrongAuthenticationMethods)) {

         [PSCustomObject]@{
           DisplayName       = $MsolUser.DisplayName
           UserPrincipalName = $MsolUser.UserPrincipalName
           isAdmin           = if ($listAdmins -and ($admins.EmailAddress -match $MsolUser.UserPrincipalName)) {$true} else {"-"}
           MFAEnabled        = $false
           MFAType           = "-"
           MFAEnforced       = if ($MsolUser.StrongAuthenticationRequirements) {$true} else {"-"}
         }
       }
     }else{
       [PSCustomObject]@{
         DisplayName       = $MsolUser.DisplayName
         UserPrincipalName = $MsolUser.UserPrincipalName
         isAdmin           = if ($listAdmins -and ($admins.EmailAddress -match $MsolUser.UserPrincipalName)) {$true} else {"-"}
         "MFA Enabled"     = if ($MsolUser.StrongAuthenticationMethods) {$true} else {$false}
         "MFA Default Type"= $Method
         "SMS token"       = if ($MsolUser.StrongAuthenticationMethods.MethodType -contains "OneWaySMS") {$true} else {"-"}
         "Phone call verification" = if ($MsolUser.StrongAuthenticationMethods.MethodType -contains "TwoWayVoiceMobile") {$true} else {"-"}
         "Hardware token or authenticator app" = if ($MsolUser.StrongAuthenticationMethods.MethodType -contains "PhoneAppOTP") {$true} else {"-"}
         "Authenticator app" = if ($MsolUser.StrongAuthenticationMethods.MethodType -contains "PhoneAppNotification") {$true} else {"-"}
         MFAEnforced       = if ($MsolUser.StrongAuthenticationRequirements) {$true} else {"-"}
       }
     }
   }
 }

Bankesy · April 17, 2023

Thanks @Oaktech

Used that script and it worked well.

Now trying to figure out why one user in particular is prompted for multi-factor authentication setup when added to the targeted security group but then told they don't have access after the 'More information required' screen.

It's almost like the conditional access policy is both allowing and denying the user to register...?

cheekycharly · April 19, 2023

So am I reading this correct you guys have multiple policies in place pointing at groups?

I envisioned I would just have two policies...

1 "Pupil Conditional Access" (Users Pupils group included, excluded any tenant admins and staff, Conditions>Locations 3 School IP's Excluded and everywhere else blocked)

2 "Staff Conditional Access" (Users Staff group included,excluded any tenant admins and pupils, Conditions>Locations 3 School IP's Excluded and anywhere else in the UK allowed as long as they have 2FA when external)

with the settings all within those two policies.

If anyone is able to show some screen grabs that would be great or point me in the direction I need to go to make those above style policies.

Bankesy · April 19, 2023

@cheekycharly

Are you asking about the polices to get users to register for SSPR and MFA (combined security info registration) or the polices to dictate when and where users will be prompted for MFA after registering?

I'm only doing staff so I have one policy prompting staff to register (inside the network only) and then a separate policy that states users will be prompted for all cloud apps (outside of the network only).

Edited April 19, 2023 by Bankesy

cheekycharly · April 20, 2023

From reading your reply it seems you make multiple different policies and assign them to the specific groups to make this work.

I will need to set it up so there is no MFA prompt for pupils to I will be exempting the IP's of the schools and the same for staff but staff are allowed to access the system externally as long as they MFA.

Edited April 20, 2023 by cheekycharly

Bankesy · April 20, 2023

@cheekycharly

Yes one policy for registering, setup exactly as per following link but targeted at staff group only:

https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-registration-mfa-sspr-combined

This doesn't enable SSPR though, you have to switch that on elsewhere in Azure Portal first.

Then a separate policy for MFA, still targeted at staff group, excluding trusted location, for all cloud apps.

Or alternatively as @TechMonkey points out there are templates to get you started.

Happy to continue discussing if you need.

Multi-Factor Authentication - Enabled Check

Recommended Posts

Bankesy

DavR

DavR

TechMonkey

DavR

howartp

Bankesy

TechMonkey

Bankesy

TechMonkey

CTIDTech

nicholab

ultima170387

Bankesy

cheekycharly

TechMonkey

Bankesy

Bankesy

TechMonkey

Oaktech

Bankesy

cheekycharly

Bankesy

cheekycharly

Bankesy

Create an account or sign in to comment

Create an account

Sign in

Recent Threads

iOS 27 BYOD and Smoothwall web filtering - Connectivity Assist causing issues?

3rd Party Warranty on Existing Panels

Edge Auto Sign in Broken / Cloud Filter

Home

Forums

What's New