Automate Documenting Customer MFA
Nick Ross · Updated · Video and write-up
Over the years, Microsoft has evolved the enforcement of multi-factor authentication into various sections of the application. These changes are making it confusing as an admin to know where to go to see a report of MFA adoption. In this article, we will cover the various methods of MFA enrollment and provide a script that you can use to report on MFA in all customer environments.
Registering for MFA
Per User MFA (Legacy Method)
Most MSPs are still probably using the MFA portal as a primary method of enforcing MFA. In this portal, there are options to set users as Disabled, Enabled, or Enforced. Enabled means that the user has a 14-day grace period to enroll a second factor. Enforced means that they are required to set this up immediately upon next sign in. The legacy method is in parenthesis here because Microsoft has mentioned they intend to deprecate this portal over time. No official date has been posted yet. This method is effective and can also be enforced via PowerShell.
Please Note If MFA is enabled through Conditional Access Policies or Security Defaults (which I cover below), the status does not accurately translate back into this portal. I.E. A CA policy enforcing MFA is enabled and a user is registered but the MFA portal still shows the user as ‘Disabled.’ ×
Conditional Access Policies
Conditional Access Policies are primarily if/then statements that grant or block access to corporate resources. If certain conditions are met, then controls are put into place. CA policies enforce MFA and scope them to certain users or groups. When a policy is established, the user will be asked to register a second factor the next time those conditions are met. CA policies require an Azure AD (Active Directory) P1 license which is usually the biggest limitation for most clients that utilize Business Standard licensing.
Security Defaults
Security Defaults were introduced at the end of 2019 and are on by default in all net new tenants. They automatically enforce MFA for all users with a 14-day grace period and require you to use the Microsoft Authenticator app. Security defaults cannot be on in addition to having a CA policy. If at least on CA policy is enabled, then Security defaults will have to be turned off.
The Script
To summarize, the methods in which you can enforce MFA make reporting a bit of a nightmare. For this reason, I created a script (opens in new tab) that pulls a report on every customer managed in partner center. The script uses the Secure Application Model (opens in new tab) to connect to your client environments and creates HTML pages that list the following:
- MFA enforced through the MFA portal
- Conditional Access Policies
- Security Defaults (enabled or disabled)
- Custom Controls (ex. DUO)
I did not cover custom controls, but they are part of CA policies and allow a 3rd party like DUO to enforce MFA. Many MSPs have this for their customers, so I wanted to add it here. This script should be run periodically to assess true MFA adoption.
I hope this provided some clarity on MFA enrollment with Microsoft! Please leave any questions or comments below.
See how your Microsoft 365 tenant measures up in about a minute.
CloudCapsule scans 300+ security controls, shows what to fix first, and keeps watching for drift after you fix it. Whether you manage one tenant or fifty, it’s the complete Microsoft 365 security workflow.
No credit card required. Results in < 2 minutes.
Keep reading
How to Manage Secrets securely in PowerShell | Azure Key Vault
In this guide, we’ll explore how you can leverage Azure Key Vault to securely manage secrets in your single-tenant or multi-tenant PowerShell scripts. This will enable you to securely access authentication tokens and other sensitive information needed to interact with downstream customer environments. Let’s dive in! Understanding the Secure Application Model Many of us are […]
Automating Basic Auth Reporting
Microsoft recently made some updates surrounding their plans to turn off basic auth in all tenants. The following article describes the recent updates: Basic Authentication and Exchange Online – September 2021 Update – Microsoft Tech Community Highlights Scope includes Exchange Web Services (EWS), Exchange ActiveSync (EAS), POP, IMAP, Remote PowerShell, MAPI, RPC, SMTP AUTH and […]
Automating Intune Device Documentation in IT Glue
As we continue to shift the management of devices to Intune, I wanted an easy way to see all of the devices across all customers. I wanted to include metadata at a multi-tenant level such as device compliance and autopilot enrollment. I created a script that creates a new flexible asset in IT Glue and […]