How to target Registration campaign only to users having Default multifactorauthentication method as Mobile?

Global Admin- TechSpace 40

We have Azure AD Tenant where lot of users registered for different MFA Methods as Push notification, Software OATH code, Mobile (Voice/SMS). we have user statistics that most users are still using Mobile (Voice/SMS) method in Azure AD tenant which can be compromised to middleman attacks. We want to force them to Authenticator App Push notification which best practice of MFA. we are using Registration campaign feature as solution for this which prompt user move to Authenticator App Push notification.

Enabling this feature is easy task, but we wanted to target users who are using Default multifactor authentication method as Mobile (Voice/SMS).

MicrosoftTeams-image

MicrosoftTeams-image (1)

How to target Registration campaign only to users having Default multifactor authentication method as Mobile? because we cannot create dynamic group to sort mobile users as there is no attribute to setup that rule.

We want that mobile users to be targeted to the group and assign that group to Registration Campaign in Azure AD.

I need your assistance in providing solution to the above Issue, Thanks in advance.

JamesTran-MSFT 36,621 Reputation points Microsoft Employee

2023-09-29T17:43:01.2333333+00:00

@Global Admin- TechSpace

I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

1 answer

Tushar Kumar 3,326 Reputation points MVP

2023-09-21T09:58:55.7+00:00
Hi Global Admin- TechSpace,

Thank you for asking your question in QnA!

I can do some test around targetting Default method users I don't have an answer for now.

I can understand your main concern here is mainly making sure users use the strong authentication method which can be achived with use of following Options :

Enable Registration Campagin for MFA with Authenticator APP (This will apply to all users unless you decide to include and exclude, people already using it will not be affected) This will make sure everyone have authenticator.

https://learn.microsoft.com/en-us/azure/active-directory/authentication/how-to-mfa-registration-campaign

Enable System Preferred MFA : This will help in prompting users to sign in by using the most secure method they registered.

https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-system-preferred-multifactor-authentication

With combination of both it will address your concern of people using weak authentication method.

Please Click " Accept as answer" if this helps.
Please sign in to rate this answer.
Global Admin- TechSpace 40 Reputation points

2023-09-21T11:03:09.4666667+00:00

Hi Tushar, Thanks for prompt response. Yes, you are correct regarding my question above, but Registration Campaign is setting up about Authenticator App push notification which is strongest authentication method then we can exclude System Preferred MFA method.

Enabling the Registration Campaign feature is easy but sorting the users having Default multifactor authentication method as mobile (Voice/SMS) to a group is complicated task (There is an option to download by sorting the users to Default authentication method as Mobile in the below image and bulk Import the user's data to the group which is manual task, and it includes lot of users in the organization wide). so, if we have any option to sort out like dynamic group or PowerShell script to do automate task without errors for lot of users.

Please let me know, once you have tested it.

Tushar Kumar 3,326 Reputation points MVP

2023-09-21T11:17:49.74+00:00

Apologies if I am understanding it wrong but your goal is all users should have MFA with Authenticator app.

Registration Campagin will automatically propmt all the users who dosn't have Authenticaor app register and leave the people alone who already have that.

Global Admin- TechSpace 40 Reputation points

2023-09-21T11:30:25.53+00:00

Yes Tushar, people having Authenticator app push notification it skips but people having Mobile (Voice/SMS), software token, Alt Mobile (user using it as backup device) they will get prompted as below previously it used to show "Improve your sign-ins" now it is showing as "Protect your account". now we want to target only Mobile users to this Feature excluding users using software token, Alt Mobile.

I wanted to thank you for assisting me and spending your time on this Tushar. :)

.

Global Admin- TechSpace 40 Reputation points

2023-09-27T10:12:10.0533333+00:00

Hi Tushar , Any update on this issue?

Tushar Kumar 3,326 Reputation points MVP

2023-09-28T10:49:08.31+00:00

There is no way that I was able to find with Dynamic groups but it can be tackled with following method.

You can use Powershell/Portal to export the menthods in excel put an filter to users with Mobile as default authentication method.

#Get all Azure users $users = get-mguser -All $results=@(); Write-Host "`nRetreived $($users.Count) users"; #loop through each user account foreach ($user in $users) { Write-Host "`n$($user.UserPrincipalName)"; $myObject = [PSCustomObject]@{ user = "-" MFAstatus = "_" email = "-" fido2 = "-" app = "-" password = "-" phone = "-" softwareoath = "-" tempaccess = "-" hellobusiness = "-" } $MFAData=Get-MgUserAuthenticationMethod -UserId $user.UserPrincipalName #-ErrorAction SilentlyContinue $myobject.user = $user.UserPrincipalName; #check authentication methods for each user ForEach ($method in $MFAData) { Switch ($method.AdditionalProperties["@odata.type"]) { "#microsoft.graph.emailAuthenticationMethod" { $myObject.email = $true $myObject.MFAstatus = "Enabled" } "#microsoft.graph.fido2AuthenticationMethod" { $myObject.fido2 = $true $myObject.MFAstatus = "Enabled" } "#microsoft.graph.microsoftAuthenticatorAuthenticationMethod" { $myObject.app = $true $myObject.MFAstatus = "Enabled" } "#microsoft.graph.passwordAuthenticationMethod" { $myObject.password = $true # When only the password is set, then MFA is disabled. if($myObject.MFAstatus -ne "Enabled") { $myObject.MFAstatus = "Disabled" } } "#microsoft.graph.phoneAuthenticationMethod" { $myObject.phone = $true $myObject.MFAstatus = "Enabled" } "#microsoft.graph.softwareOathAuthenticationMethod" { $myObject.softwareoath = $true $myObject.MFAstatus = "Enabled" } "#microsoft.graph.temporaryAccessPassAuthenticationMethod" { $myObject.tempaccess = $true $myObject.MFAstatus = "Enabled" } "#microsoft.graph.windowsHelloForBusinessAuthenticationMethod" { $myObject.hellobusiness = $true $myObject.MFAstatus = "Enabled" } } } ##Collecting objects $results+= $myObject; } # Display the custom objects $results

You can use the above script to get the details and once you have filtered out the users You can use the same CSV and create a script to make a group based on the CSV.

If you want to go with the Dynamic route it requries more of effort on your side as it is not available out of the box and a lot of requests pending on Uservoice.

Below is the workaround to use Graph APIs and power automate to create a group based on the authentication method.

https://janbakker.tech/use-power-automate-for-your-custom-dynamic-groups/

Hope this helps. Please click "Accept as answer" if it does

Global Admin- TechSpace 40 Reputation points

2023-10-05T03:50:12.76+00:00

Hi Tushar, Thanks for the update , I will test on my tenant and get back to you on this.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to target Registration campaign only to users having Default multifactorauthentication method as Mobile?

1 answer

Your answer