What is replacing MSOL & AAD StrongAuthenticationRequirement and provisioning errors?

Question

What is replacing MSOL & AAD StrongAuthenticationRequirement and provisioning errors?

Kane 5

WIth the AzureAD and MSOL PowerShell modules upcoming retirement, I have been doing research into how to replace them and all signs point to the usage of Graph but it appears that there are several if not more features that are missing at present.

Firstly:

The ability to set Strong Authentication methods.

https://learn.microsoft.com/en-us/graph/api/resources/authenticationmethods-overview?view=graph-rest-1.0&preserve-view=true

The document above shows that at present Set-MsolUser is the only way to achieve this. But given its going to be retired potentially at the end of March(!?) how will this be done after this time? Set-AzureADUser has never had this capability and is also going away. Update-MgUser appears to not cover this at all either.

Also shown here is a document still showing the user of Set-Msoluser despite the deprecation and upcoming retirement:
https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates

Secondly:

How does one pull the provisioning errors that can happen for investigation? Traditionally Get-MsolUser and Get-AzureADUser allow at least the ability to see these errors to allow for investigation. The current replacement I have found Get-MGUser does not appear to make this information available.

With these being retired as soon as March or June 30 depending on who you ask there is at present no way to achieve this in the mean time and is a significant impact on our capability to provision users. We have tens of thousands of employees and can provision upwards of a thousand per day. The loss of this ability is a significant increase in workload.

Givary-MSFT 35,791 Reputation points Microsoft Employee Moderator

2023-02-27T10:59:30.29+00:00

@Kane Thank you for reaching out to us, As I understand you are looking for Per-User MFA status in MSOnline module replacement, under MSGraph.

Based on the discussion I had with my team internally on this issue, the new direction is to move away from per-user enforcement, and to leverage Security Defaults or Conditional Access to enforce MFA.

Also we advise to leverage the Authentication Methods and Authentication Strengths policies to control what methods a user can and must use, both of which have corresponding MS Graph APIs and cmdlets.

Regarding provisioning errors, can you help with the commands/script that being used using with Get-msoluser or Get-AzureADuser for provisioning errors so that I can research on the same and check what we have to offer against Get-Mguser cmdlet.

Let me know if you have any further questions, feel free to post back.

Your answer

Givary-MSFT 35,791 Reputation points Microsoft Employee Moderator

2023-02-27T10:59:30.29+00:00

@Kane Thank you for reaching out to us, As I understand you are looking for Per-User MFA status in MSOnline module replacement, under MSGraph.

Based on the discussion I had with my team internally on this issue, the new direction is to move away from per-user enforcement, and to leverage Security Defaults or Conditional Access to enforce MFA.

Also we advise to leverage the Authentication Methods and Authentication Strengths policies to control what methods a user can and must use, both of which have corresponding MS Graph APIs and cmdlets.

Regarding provisioning errors, can you help with the commands/script that being used using with Get-msoluser or Get-AzureADuser for provisioning errors so that I can research on the same and check what we have to offer against Get-Mguser cmdlet.

Let me know if you have any further questions, feel free to post back.