Show MFA Disabled Users

nethead3145 · 2020-12-14T16:42:31.000Z

I’m new to Powershell and have this script to show enabled/enforced MFA users. It runs perfectly and teh export file has the what I need. The page I got it from says that it can be edited to show only disabled MFA users, which is what I’m trying to find out. I’ve seen examples of strings to put in but I don’t know enough yet to get it to run. Any help or suggestions would be greatly appreciated.

Param(    [Parameter(Mandatory = $false)]    [switch]$DisabledOnly,    [switch]$EnabledOnly,    [switch]$EnforcedOnly,    [switch]$ConditionalAccessOnly,    [switch]$AdminOnly,    [switch]$LicensedUserOnly,    [Nullable[boolean]]$SignInAllowed = $null,    [string]$UserName,    [string]$Password)#Check for MSOnline module$Modules=Get-Module -Name MSOnline -ListAvailableif($Modules.count -eq 0){  Write-Host  Please install MSOnline module using below command: `nInstall-Module MSOnline  -ForegroundColor yellow  Exit}#Storing credential in script for scheduling purpose/ Passing credential as parameterif(($UserName -ne "") -and ($Password -ne "")){ $SecuredPassword = ConvertTo-SecureString -AsPlainText $Password -Force $Credential  = New-Object System.Management.Automation.PSCredential $UserName,$SecuredPassword Connect-MsolService -Credential $credential}else{ Connect-MsolService | Out-Null}$Result=""$Results=@()$UserCount=0$PrintedUser=0#Output file declaration$ExportCSV=".\MFADisabledUserReport_$((Get-Date -format yyyy-MMM-dd-ddd` hh-mm` tt).ToString()).csv"$ExportCSVReport=".\MFAEnabledUserReport_$((Get-Date -format yyyy-MMM-dd-ddd` hh-mm` tt).ToString()).csv"#Loop through each userGet-MsolUser -All | foreach{ $UserCount++ $DisplayName=$_.DisplayName $Upn=$_.UserPrincipalName $MFAStatus=$_.StrongAuthenticationRequirements.State $MethodTypes=$_.StrongAuthenticationMethods $RolesAssigned="" Write-Progress -Activity "`n     Processed user count: $UserCount "`n"  Currently Processing: $DisplayName" if($_.BlockCredential -eq "True") {  $SignInStatus="False"  $SignInStat="Denied" } else {  $SignInStatus="True"  $SignInStat="Allowed" } #Filter result based on SignIn status if(($SignInAllowed -ne $null) -and ([string]$SignInAllowed -ne [string]$SignInStatus)) {  return } #Filter result based on License status if(($LicensedUserOnly.IsPresent) -and ($_.IsLicensed -eq $False)) {  return } if($_.IsLicensed -eq $true) {  $LicenseStat="Licensed" } else {  $LicenseStat="Unlicensed" } #Check for user's Admin role $Roles=(Get-MsolUserRole -UserPrincipalName $upn).Name if($Roles.count -eq 0) {  $RolesAssigned="No roles"  $IsAdmin="False" } else {  $IsAdmin="True"  foreach($Role in $Roles)  {   $RolesAssigned=$RolesAssigned+$Role   if($Roles.indexof($role) -lt (($Roles.count)-1))   {    $RolesAssigned=$RolesAssigned+","   }  } } #Filter result based on Admin users if(($AdminOnly.IsPresent) -and ([string]$IsAdmin -eq "False")) {  return } #Check for MFA enabled user if(($MethodTypes -ne $Null) -or ($MFAStatus -ne $Null) -and (-Not ($DisabledOnly.IsPresent) )) {  #Check for Conditional Access  if($MFAStatus -eq $null)  {   $MFAStatus='Enabled via Conditional Access'  }  #Filter result based on EnforcedOnly filter  if((([string]$MFAStatus -eq "Enabled") -or ([string]$MFAStatus -eq "Enabled via Conditional Access")) -and ($EnforcedOnly.IsPresent))  {   return  }  #Filter result based on EnabledOnly filter  if(([string]$MFAStatus -eq "Enforced") -and ($EnabledOnly.IsPresent))  {   return  }  #Filter result based on MFA enabled via Other source  if((($MFAStatus -eq "Enabled") -or ($MFAStatus -eq "Enforced")) -and ($ConditionalAccessOnly.IsPresent))  {   return  }  $Methods=""  $MethodTypes=""  $MethodTypes=$_.StrongAuthenticationMethods.MethodType  $DefaultMFAMethod=($_.StrongAuthenticationMethods | where{$_.IsDefault -eq "True"}).MethodType  $MFAPhone=$_.StrongAuthenticationUserDetails.PhoneNumber  $MFAEmail=$_.StrongAuthenticationUserDetails.Email  if($MFAPhone -eq $Null)  { $MFAPhone="-"}  if($MFAEmail -eq $Null)  { $MFAEmail="-"}  if($MethodTypes -ne $Null)  {   $ActivationStatus="Yes"   foreach($MethodType in $MethodTypes)   {    if($Methods -ne "")    {     $Methods=$Methods+","    }    $Methods=$Methods+$MethodType   }  }  else  {   $ActivationStatus="No"   $Methods="-"   $DefaultMFAMethod="-"   $MFAPhone="-"   $MFAEmail="-"  }  #Print to output file  $PrintedUser++  $Result=@{'DisplayName'=$DisplayName;'UserPrincipalName'=$upn;'MFAStatus'=$MFAStatus;'ActivationStatus'=$ActivationStatus;'DefaultMFAMethod'=$DefaultMFAMethod;'AllMFAMethods'=$Methods;'MFAPhone'=$MFAPhone;'MFAEmail'=$MFAEmail;'LicenseStatus'=$LicenseStat;'IsAdmin'=$IsAdmin;'AdminRoles'=$RolesAssigned;'SignInStatus'=$SigninStat}  $Results= New-Object PSObject -Property $Result  $Results | Select-Object DisplayName,UserPrincipalName,MFAStatus,ActivationStatus,DefaultMFAMethod,AllMFAMethods,MFAPhone,MFAEmail,LicenseStatus,IsAdmin,AdminRoles,SignInStatus | Export-Csv -Path $ExportCSVReport -Notype -Append } #Check for MFA disabled user elseif(($DisabledOnly.IsPresent) -and ($MFAStatus -eq $Null) -and ($_.StrongAuthenticationMethods.MethodType -eq $Null)) {  $MFAStatus="Disabled"  $Department=$_.Department  if($Department -eq $Null)  { $Department="-"}  $PrintedUser++  $Result=@{'DisplayName'=$DisplayName;'UserPrincipalName'=$upn;'Department'=$Department;'MFAStatus'=$MFAStatus;'LicenseStatus'=$LicenseStat;'IsAdmin'=$IsAdmin;'AdminRoles'=$RolesAssigned; 'SignInStatus'=$SigninStat}  $Results= New-Object PSObject -Property $Result  $Results | Select-Object DisplayName,UserPrincipalName,Department,MFAStatus,LicenseStatus,IsAdmin,AdminRoles,SignInStatus | Export-Csv -Path $ExportCSV -Notype -Append }}#Open output file after executionWrite-Host `nScript executed successfullyif((Test-Path -Path $ExportCSV) -eq "True"){ Write-Host "MFA Disabled user report available in: $ExportCSV" $Prompt = New-Object -ComObject wscript.shell $UserInput = $Prompt.popup("Do you want to open output file?",` 0,"Open Output File",4) If ($UserInput -eq 6) {  Invoke-Item "$ExportCSV" } Write-Host Exported report has $PrintedUser users}elseif((Test-Path -Path $ExportCSVReport) -eq "True"){ Write-Host "MFA Enabled user report available in: $ExportCSVReport" $Prompt = New-Object -ComObject wscript.shell $UserInput = $Prompt.popup("Do you want to open output file?",` 0,"Open Output File",4) If ($UserInput -eq 6) {  Invoke-Item "$ExportCSVReport" } Write-Host Exported report has $PrintedUser users}Else{  Write-Host No user found that matches your criteria.}#Clean up sessionGet-PSSession | Remove-PSSession

Neally · 2020-12-14T16:52:51.000Z

If you post code, please use the ‘Insert Code’ button. Please and thank you!

PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum! Programming & Development

Hi, and welcome to the PowerShell forum! Don’t apologize for being a “noob” or “newbie” or “n00b.” There’s just no need – nobody will think you’re stupid, and the forums are all about asking questions. Just ask! Use a descriptive subject. Don’t say “Need help” or “PowerShell Help”, actually summarize what the problem is. It helps the rest of us keep track of which problem is which. Don’t post massive scripts. We’re all volunteers and we don’t have time to read all that, nor will we copy…

PatrickFarrell · 2020-12-14T16:54:01.000Z

Looks like you are using this script:

Office 365 Reports – 9 May 19

Export Office 365 Users MFA Status to CSV Using PowerShell

This PowerShell script exports Office 365 users’ MFA status with Default MFA Method, AllMFAMethods, MFAPhone, MFAEmail,LicenseStatus, IsAdmin, SignInStatus.

Est. reading time: 8 minutes

Export Office 365 users’ MFA disabled status to CSV file

-DisabledOnly param used to filter output that only displays MFA disabled users. i.e,Users without MFA.

./GetMFAStatus.ps1 -DisabledOnly

Neally · 2020-12-14T16:56:19.000Z

Without digging too deep into it,

try to edit this:

$Results | 
Select-Object DisplayName,UserPrincipalName,Department,MFAStatus,LicenseStatus,IsAdmin,AdminRoles,SignInStatus |
where MFAStatus -eq 'false' |
Export-Csv -Path $ExportCSV -Notype -Append

I am not sure what the actual value is if it is, false, $false or disabled? So you need to adjust it to make, but basically, the where-object statement should filter out only the MFASTATUS ones that are set to a specific value.

nethead3145 · 2020-12-14T16:56:35.000Z

First post in this group. Thanks for the heads up on posting code.

nethead3145 · 2020-12-14T17:16:38.000Z

Thanks. Where am I inserting this parameter? Like I said, I’m totally new at Powershell.

PatrickFarrell · 2020-12-14T17:28:38.000Z

For my reply, you don’t insert it into the code. You have that powershell script saved to a file, you run the file with a parameter.

./GetMFAStatus.ps1 -DisabledOnly

Neally · 2020-12-14T17:46:53.000Z

NetHead3145:

Thanks. Where am I inserting this parameter? Like I said, I’m totally new at Powershell.

If you mean what I posted, you replace it with what you currently have.

nethead3145 · 2020-12-14T17:47:34.000Z

Ok now I’m following. Appreciate that.

nethead3145 · 2020-12-14T18:03:51.000Z

That worked perfectly!!! Thanks for your help.

PatrickFarrell · 2020-12-14T18:07:29.000Z

You’re welcome.

Welcome to the community.