• State Suggested Answer
  • Replies 4 replies
  • Answers 1 answer
  • Subscribers 62 subscribers
  • Views 714 views
  • Users 0 members are here
Options
Related

setting MFA during account creation

charleneforbes
5 months ago

Hi,

Another custom script query following the one I had the other week.  We've got a script that switches on MFA to have SMS as the default but doesn't set a number.  We do this as a measure to prevent people who haven't had MFA set up having their credentials hacked and then someone using them to log in and then set MFA to what they want.  There's a control list that doesn't prompt for MFA within our network so the users or admin can log in within our network and set the number to correct one if they wish, and for a hacker they get stuck by the MFA prompt that goes nowhere.

$credential = Import-Clixml -Path 'PATH'

connect-msolservice -Credential $credential
$UserUPN = $workflow.SavedObjectProperties("Get UserPrincipalName").get("UserPrincipalName")

	$SMS = New-Object -TypeName Microsoft.Online.Administration.StrongAuthenticationMethod
	$SMS.IsDefault = $true
	$SMS.MethodType = "OneWaySMS"
	$Phone = New-Object -TypeName Microsoft.Online.Administration.StrongAuthenticationMethod
	$Phone.IsDefault = $false
	$PrePopulate = @($SMS)

Set-MsolUser -UserPrincipalName $UserUPN -StrongAuthenticationMethods $PrePopulate

MSOL is old hat now, I know, but at the time this was the only way we could set this as Microsoft squirrels away the MFA settings and won't let a third party manipulate them.  This script still works if I run it manually with Powershell but as part of a workflow it fails and I can't find anyone else trying to do the same thing.  Graph might be able to do it but I'm struggling to find anything that does exactly what the above does.  Has anyone else come across this kind of script before and could have an alternative means of doing it?  It seems bananas that MS doesn't have an easy way of doing this!

As an aside, I'm looking at changing how the authentication is done to use a certificate as well instead of Clixml, once I can get the scripts working, because the above method works fine so getting the scripts sorted is more pressing.

We're on Active Roles 8.1.3 SP1 and Powershell version 5.1

Thanks in advance

  • 0 5 months ago

    Have you tried wrapping this in try/catch so you can capture the failure(s)?

    Just from a coding style perspective, here's how I typically handle critical operations

    Try
    {
    # Your code goes here
    }
    Catch
    {
    # NOTE:  'Logit' is a simple log-to-text-file function I add to most of my scripts
    Logit "Uh oh, something went wrong"
    Logit $Error[0] # return the error from OS
    }

    Also, are you importing the MSOL module at the beginning of your script?

  • 0 5 months ago

    Also, this:

    $UserUPN = $workflow.SavedObjectProperties("Get UserPrincipalName").get("UserPrincipalName")

    ...won't work if UPN isn't part of the $Request coming into the AR server.

    You might be better off trying:

    $UserUPN = $DirObj.get("userprincipalname") # fetch the UPN of the in-process object.

  • 0 5 months ago in reply to JohnnyQuest

    Hi, thanks for the suggestions.  The username is fed in through an earlier bit of the workflow with a save object properties activity, and yes I'm calling msol at the start of the script, which is where the error lies in the change history.  From what I've read up msol is deprecated unless you user Powershell for Windows, which I assume is why running it manually works.  I hope that makes sense.

  • 0 3 months ago in reply to charleneforbes

    Apologies, I never updated the forum with the solution we found.  We found a workaround where instead of the Active Roles script applying the MFA setting we wanted we store the name in a csv file.  I then created a scheduled task to make the change the same way we always did every half hour because the command works in native Powershell, just not via AR.  It's working well.  Thanks to everyone for the suggestions.