Script Help for MSOnline

eric-schroeder · 2018-06-04T18:43:44.000Z

The base of this script:

To find the status of all users’ MFA status in O365

The issue is we have 28,000 users and I only need to get status from the users who happen to be apart of this AD group (Roughly 3000 users) but I cant seem to filter users by a certain group they belong too.

Roughly the original script before filtering:

##Get Users and DIsplay their MFA status & Export to CSV
Get-MsolUser -all | select DisplayName,UserPrincipalName,@{N="MFA Status"; E={ if( $_.StrongAuthenticationRequirements.State -ne $null){ $_.StrongAuthenticationRequirements.State} else { "Disabled"}}} | Export-CSV -Path O365MFA.csv -Force

Neally · 2018-06-04T18:46:25.000Z

If you post code, please use the ‘Insert Code’ button. Please and thank you!

PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum! Programming & Development

Hi, and welcome to the PowerShell forum! Don’t apologize for being a “noob” or “newbie” or “n00b.” There’s just no need – nobody will think you’re stupid, and the forums are all about asking questions. Just ask! Use a descriptive subject. Don't say "Need help" or "PowerShell Help", actually summarize what the problem is. It helps the rest of us keep track of which problem is which. Don’t post massive scripts. We’re all volunteers and we don’t have time to read all that, nor will we copy, past…

As for the status, why don’t you first get all the users and then check their status? Or you can match them

Get the status for everyone
Get all the groupmembers

Match where groupmember -eq everyone get the MFA status ¯_(ツ)_/¯

eric-schroeder · 2018-06-04T19:08:43.000Z

That could work if I can find a way to list all Users in a certain group beforehand and then query for MFA status. MSOLGroup parameters don’t do that though.

Neally · 2018-06-04T19:11:12.000Z

Yeah, get it from AD?

eric-schroeder · 2018-06-04T19:15:10.000Z

That’s kinda what I was working on just now but I guess I’m trying to wrap my mind around how to now port that filtered set of users into the MFA status query?

Neally · 2018-06-04T19:28:53.000Z

I match them by UPN
You have to adjust the “@domain.com” do your UPN / domain name
This also assumes that the samaccountname and the first UPN part match

$groupmembers  = get-adgroupmember $YourGroupNameHEre
$All_MSOlusers = get-msoluser -all 

$data = foreach($member in $groupmembers){
   $All_msolusers | where UserPrincipalName -eq "$($member.samaccountname)@domain.com" |
   select DisplayName,UserPrincipalName,@{N="MFA Status"; E={ if( $_.StrongAuthenticationRequirements.State -ne $null){ $_.StrongAuthenticationRequirements.State} else { "Disabled"}}}
}

$data | Export-CSV -Path "O365MFA.csv" -NoTypeInformation -Force