Script repository
The script enables MFA in Microsoft 365 for the target user with phone number applied. To execute the script, create a business rule, custom command or scheduled task configured for the User object type.
To use the script, install Microsoft.Graph on the computer where Adaxes service runs.
Parameters
$phoneType- the phone type for multi-factor authentication.$phoneNumberProperty- the directory schema name of the property containing the required phone number.
$phoneType = "mobile" # TODO: modify me
$phoneNumberPropertyName = "telephoneNumber" # TODO: modify me
# Get phone number.
try
{
$phoneNumber = $Context.TargetObject.Get($phoneNumberPropertyName)
}
catch
{
$Context.LogMessage("Phone number is not specified", "Warning")
return
}
if ($NULL -eq $Context.TargetObject.AzureId)
{
$Context.LogMessage("The user doesn't have an account in Microsoft 365", "Warning")
return
}
try
{
# Connect to Microsoft Graph.
$token = ConvertTo-SecureString $Context.CloudServices.GetAzureAuthAccessToken() -AsPlainText -Force
Connect-MgGraph -AccessToken $token
# Enable the authentication method.
try
{
New-MgUserAuthenticationPhoneMethod -UserId $Context.TargetObject.AzureId -PhoneType $phoneType -PhoneNumber $phoneNumber -ErrorAction Stop
}
catch
{
throw $_.Exception
}
}
finally
{
# Release resources
Disconnect-MgGraph
}
Comments 2
You must be signed in to comment.
Mike
Could you please share a script to only enable MFA without selecting MFA method.
Support
Hello Mike,
Unfortunately, we do not have such a script. Moreover, it looks like there is no such possibility since the deprecation of the MSOnline PowerShell module. However, you can try checking with Microsoft support.