Cannot set up MFA over Powershell: Access Denied

Question

Hello Everyone

I have this nifty script to manage my users:

function AssignPhoneNumber {
    # Connect to Microsoft-teams
    Connect-MicrosoftTeams
    # User Principal Name (UPN) of the user
    $userUPN = Read-Host "Enter the Username"

    # Phone number to be assigned
    $phoneNumber = Read-Host "Enter the Phone Number"

    # SKU ID of the Teams Phone Standard license
    $teamsPhoneSkuID = "MCOEV"

    # Get the user object
    $user = Get-AzureADUser -ObjectId $userUPN

    # Set the usage location to Switzerland (CH)
    Set-AzureADUser -ObjectId $user.ObjectId -UsageLocation "CH"

    # Wait a few seconds to ensure the location is updated
    Start-Sleep -Seconds 5

    # Create a new license object for Teams Phone Standard
    $license = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicense
    $license.SkuId = (Get-AzureADSubscribedSku | Where-Object { $_.SkuPartNumber -eq $teamsPhoneSkuID }).SkuId

    # Create a license assignment object
    $licenses = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicenses
    $licenses.AddLicenses = $license

    # Assign the Teams Phone Standard license to the user
    Set-AzureADUserLicense -ObjectId $user.ObjectId -AssignedLicenses $licenses

    # Wait a few seconds to ensure the license has been assigned
    Write-Host "Please wait 60 seconds until the license has been assigned"
    Start-Sleep -Seconds 60
    # Assign the phone number
    Set-CsPhoneNumberAssignment -Identity $userUPN -PhoneNumber $phoneNumber -PhoneNumberType DirectRouting
    Set-CsPhoneNumberAssignment -Identity $userUPN -EnterpriseVoiceEnabled $true

    # Assign the dial plan and voice routing policy
    Grant-CsTenantDialPlan -Identity $userUPN -PolicyName "CH-Switzerland"
    Grant-CsOnlineVoiceRoutingPolicy -Identity $userUPN -PolicyName "CH-Switzerland-International"


    # Update the phone number in on-premise Active Directory
    $adUser = Get-ADUser -Filter { UserPrincipalName -eq $userUPN }
    Set-ADUser -Identity $adUser -Replace @{telephoneNumber = $phoneNumber}
}

# Function to check and install required modules
function Install-RequiredModules {
    $modules = @("AzureAD", "MSOnline", "MicrosoftTeams")
    foreach ($module in $modules) {
        $installedModule = Get-InstalledModule -Name $module -ErrorAction SilentlyContinue
        $availableModule = Get-Module -ListAvailable -Name $module -ErrorAction SilentlyContinue

        if (-not $installedModule -and -not $availableModule) {
            Write-Host "$module module is not installed. Installing..."
            Install-Module -Name $module -Force -Scope CurrentUser
        } elseif (-not $availableModule) {
            Write-Host "$module module is installed but not available in the current session. Loading module..."
            Import-Module -Name $module
        } else {
            Write-Host "$module module is already installed and available."
        }
    }
}






function EnableMFA {
[CmdletBinding()]
    param(
        [Parameter(ValueFromPipelineByPropertyName=$True)]
        $ObjectId,
        [Parameter(ValueFromPipelineByPropertyName=$True)]
        $UserPrincipalName,
        [ValidateSet("Disabled", "Enabled", "Enforced")]
        $State
    )

    Process {
        Write-Verbose ("Setting MFA state for user '{0}' to '{1}'." -f $ObjectId, $State)
        $Requirements = @()
        if($State -ne "Disabled") {
            $Requirement = [Microsoft.Online.Administration.StrongAuthenticationRequirement]::new()
            $Requirement.RelyingParty = "*"
            $Requirement.State = $State
            $Requirements += $Requirement
        }

        Set-MsolUser -ObjectId $ObjectId -UserPrincipalName $UserPrincipalName -StrongAuthenticationRequirements $Requirements
    }
}


$ADUsers = Get-ADUser -Filter * -Properties WhenCreated | Where-Object {$_.WhenCreated -gt ([DateTime]::Today)}
if ($ADUsers -ne $null) {
    Connect-MsolService
    foreach($ADUser in $ADUsers) {
        $AzureADUser = Get-MsolUser -UserPrincipalName $ADUser.UserPrincipalName
        if($AzureADUser -ne $null) {
            Set-MfaState -ObjectId $AzureADUser.ObjectId -UserPrincipalName $AzureADUser.UserPrincipalName -State Enabled
        }
    }
}




    




function ShowMenu {
    Install-RequiredModules
    $isValidChoice = $false
    while (-not $isValidChoice) {
        Write-Host "Select an option:"
        Write-Host "1. EnableMFA for a User and set temporary Password to Win-8400 "
        Write-Host "2. Assign Phone Number and Teams Phone Standard License"
        Write-Host "3. Exit"
        $choice = Read-Host "Enter your choice (1, 2, or 3)"

        switch ($choice) {
            1 {
                EnableMFA
                $isValidChoice = $true
            }
            2 {
                AssignPhoneNumber
                $isValidChoice = $true
            }
            3 {
                Write-Host "Exiting script..."
                exit
            }
            default {
                Write-Host "Invalid choice, please select 1, 2, or 3."
            }
        }
    }
}


# Install required modules
#Install-RequiredModules

# Connect to MSOlService
Import-Module MSOnline
Connect-MsolService


# Connect to Azure AD
Connect-AzureAD



# Show the menu
$userUPN = Read-Host "Enter the Username (UPN)"
ShowMenu

But recently i get this error:

Set-MsolUser : Access Denied. You do not have permissions to call this cmdlet. At C:\Users\GBU101\OneDrive - WinGD\Ex_Powershell\Usercreator.ps1:96 char:9 + Set-MsolUser -ObjectId $ObjectId -UserPrincipalName $UserPrin ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : OperationStopped: (:) [Set-MsolUser], MicrosoftOnlineException + FullyQualifiedErrorId : Microsoft.Online.Administration.Automation.AccessDeniedException,Microsoft.Online.Administration.Automation.SetUs er But I have the role of global admin, security admin, authentication admin, and privileged authentication admin

I already tried these steps:

• My Account has these roles: Global Administrator, Authentication Administrator, Privileged Authentication Adminitsrator and Security Administrator
• I am running Powershell as a local admin
• I reinstalled the MSONline Module
• I closed and reopened the session
• I tried on multiple devices with the same issue

Running the command over MGGRaph gives me the same error (403: Forbidden)

Do you may know what i can do to solve this issue?