Need alternate API for MSOnline (StrongAuthenticationRequirements) based per user MFA management

Question

Need alternate API for MSOnline (StrongAuthenticationRequirements) based per user MFA management

Janakar 1

1 answer

Your answer

Answer 1

Vasil Michev 118.1K MVP Moderator

There is no direct replacement for that, as per-user MFA is eventually going away. To manage auth methods for users, including MFA methods, you can use the /authentication/methods endpoints: https://learn.microsoft.com/en-us/graph/api/resources/authenticationmethods-overview?view=graph-rest-beta

To set a default MFA method, you can use the freshly released /authentication/signInPreferences endpoint: https://www.michev.info/blog/post/5662/configure-users-default-mfa-method-via-the-graph-api

CarlZhao-MSFT 46,346 Reputation points

2023-06-21T05:33:55.6633333+00:00

Hi @Janakar

Hope things are going well. I am writing to see if the above suggestions help. If there's anything else we can help, feel free to let us know.
Christian 185 Reputation points

2024-01-03T11:29:39.4733333+00:00
Hi @Vasil Michev
You say that "per-user MFA" is eventually going away. For a long time we suspect this will going to happen as "Conditional Access is the way to go". Nevertheless per-user MFA is a feature now, nowhere in the documentation that we regularly examine explains that "it's going away", and many customers for whatever reason still use it. When Connect-Msol goes away (that was scheduled for a long time now but luckly still works), we won't have a way to programatically check if an user has per-user MFA Enabled / Enforced. AFAIK there isn't a way to check this with graph. We develop a custom security solution that checks MFA both via Conditional Access and per-user MFA (using the good'ol MsOnline) and there isn't just a way to check if a user has per-user MFA enabled/enforced, am I right?

We were specifically using something like:

$Account = Get-MsolUser <someuser> $State= $Account | Select-Object -ExpandProperty StrongAuthenticationRequirements If ($Null -ne $State.State) { $MFAStatus = $State.State } Else { $MFAStatus = 'Disabled' }

This allowed us to check the exact value that the user has established in the old per-user mfa portal (https://account.activedirectory.windowsazure.com/UserManagement/MultifactorVerification.aspx?culture=en-US&BrandContextID=O365)

Edit: There is indeed informationt hat "legacy MFA and SSPR" policies are deprecated, but as we understand it doesn't affect Enable/Enforce per-user MFA, only the "methods available for user"
https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-methods-manage#legacy-mfa-and-sspr-policies

Share via

Need alternate API for MSOnline (StrongAuthenticationRequirements) based per user MFA management

1 answer

Your answer