How to check if a predetermined list of users has mfa enabled via script or powershell command

Question

I need to check if users on a list have mfa enabled. There are many users to consult on the Portal. And I also don't want to do the query using the get-mfareports.ps1 script that brings the status of all users, as I would have to compare line by line with the list I already have.

Answer 1

There's no need for you to compare the lists manually.

That script is capable of creating a CSV file. Put your list in another CSV file and create a hash from whatever list is shorter. If a user is in the CSV produced by the script isn't in your list, you can write another file containing the information you need to add that user to your list.

Answer 2

@Selma Saglauskas Dias Gambarini

Thank you for your post and I apologize for the delayed response!

From your issue, I understand that you have a pre-determined list of users, and you'd like a PowerShell script to check if the users on that list have MFA enabled. To hopefully resolve your issue or point you in the right direction, you should be able to accomplish this using the PS script(s) below.

Note: Prior to following the below script you'll need to create a list of users that you want to check. You can do this by creating a CSV file with a column for the user's email address. For example:

---

For more info on Azure Active Directory (MSOnline):

#Install the Azure AD MSOnline Module
Install-Module MSOnline

#Connect to your Azure AD tenant
Connect-MsolService

#Load the list of pre-defined users into PowerShell by running the following command:
$users = Import-Csv -Path "C:\path\Desktop\users.csv"

#Create an empty array to store the results:
$results = @()

#Loop through the list of users and check if MFA is enabled for each user. Instead of writing the results to the console, we'll be adding them to the $results array:

foreach ($user in $users) {
	$userObject = Get-MsolUser -UserPrincipalName $user.Email
	$mfaStatus = $userObject.StrongAuthenticationMethods.Count
	$result = New-Object -TypeName PSObject -Property @{
	Email = $user.Email
	MFAEnabled = $mfaStatus -gt 0 
	}
	$results += $result

}

#Export the $results array to a CSV file:
$results | Export-Csv -Path "C:\path\to\results.csv" -NoTypeInformation

---

I hope this helps!

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

---

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Answer 3

This is a modified version of the code submitted by @JamesTran-MSFT . If it still produces incorrect results you can check if one of the StrongAuthenticationMethods has its "IsDefault" property set to $true.

Install-Module MSOnline         # you can remove this if the module's already installed

#Connect to your Azure AD tenant
Connect-MsolService

Import-Csv -Path "C:\path\Desktop\users.csv"

#Loop through the list of users and check if MFA is enabled for each user. Instead of writing the results to the console, we'll create a CSV
Import-Csv -Path "C:\path\Desktop\users.csv" |
    ForEach-Object {
        Try{
            $email = $_.Email   # used only in 'Catch' block
	        $userObject = Get-MsolUser -UserPrincipalName $_.Email -ErrorAction STOP
            [PSCustomObject]@{
                Email = $_.Email
                MFAEnabled = (if ($userObject.StrongAuthenticationMethods){$true}else{$false}) 
    	    }
        }
        Catch{
            Write-Host "User '$email' was not found."
        }
} | Export-Csv -Path "C:\path\to\results.csv" -NoTypeInformation