Office365 Powershell

[glenimp617]

Hi Everyone,

I have knocked up a quick powershell script to enforce MFA for all O365 users, however I need to exclude anyone who is a member of a certain group.

Here's the code I have come up with.

Can anyone do any better?

$users = Get-MsolUser -All | where {$_.StrongAuthenticationRequirements.state -notlike "Enforced"} | select userprincipalname

#--- Setting MFA status to Enforced ---
$st = New-Object -TypeName Microsoft.Online.Administration.StrongAuthenticationRequirement
$st.RelyingParty = "*"
$st.State = "Enforced"
$sta = @($st)

foreach ($user in $users)
{
$user = $user.userprincipalname

foreach ($Group in (Get-MsolGroup -All | where-object {$_.displayname -eq "MFA-Excluded"}))
{
if (Get-MsolGroupMember -GroupObjectId $Group.ObjectId | where {$_.Emailaddress -notlike $user}) {
write-host "Setting MFA for user $user to Enforced" -ForegroundColor Green
Add-Content "C:\mfa\log.txt" "$Fulldate - Setting MFA for user $user to Enforced"
Set-MsolUser -UserPrincipalName $user -StrongAuthenticationRequirements $sta
}
}
}

Thanks!!

 

[glenimp617]

What about something like this

$grouptoexclude = ***insert name of group***
$certaingroupmembers = (Get-MsolGroupMember -GroupObjectId $grouptoexclude -MemberObjectTypes user).ObjectId

Then change your query to something like

$users = Get-MsolUser -All | where {$_.StrongAuthenticationRequirements.state -notlike "Enforced" -and  $_.ObjectID -notin $certaingroupmembers} | select userprincipalname

You get the idea

Yeah, I see

I didn't think my code was very efficient lol

Thanks!!

 

[glenimp617]

Just out of interest, why dont you have a conditional access rule that requires everyone to use MFA from non-trusted IPs and just add the group to the Exclusions - set it up once and forget about it, users will soon sign up for MFA

Yeah that's a good idea actually. We use conditional access to block anything outside the UK already. I think we started going down this route when we were starting to roll it out. Now we have everyone on it, there's no reason not to use those policies.