27 lines
1.0 KiB
PowerShell
27 lines
1.0 KiB
PowerShell
# Enable MFA for all licenced users who don't currently have it enabled
|
|
#
|
|
|
|
# Import MSOnline module and connect
|
|
Import-Module MSOnline
|
|
Connect-MsolService
|
|
|
|
# Create an object containing the authentication requirements
|
|
$authReq = New-Object -TypeName Microsoft.Online.Administration.StrongAuthenticationRequirement
|
|
|
|
# Include all relying parties
|
|
$authReq.RelyingParty = '*'
|
|
|
|
# Set MFA state to enabled
|
|
# Enabled allows connected apps to keep working until the user completes MFA set up.
|
|
# This can also be set to enforced which would disconnect everything immediately.
|
|
$authReq.State = 'Enabled'
|
|
|
|
# Set the cut off date before which registered devices should require re-connecting with MFA
|
|
$authReq.RememberDevicesNotIssuedBefore = (Get-Date)
|
|
|
|
# Find all licenced users who do not currently have MFA enabled or enforced
|
|
$usersToChange = Get-MsolUser | Where-Object {$_.StrongAuthenticationRequirements.State -notmatch 'Enabled|Enforced' -and $_.isLicensed -eq $true}
|
|
|
|
# Enable MFA for those users
|
|
$usersToChange | Set-MsolUser -StrongAuthenticationRequirements $authReq
|