🔒✨MFA & Passless Deployment: Simplify & Secure🔑💡
MfaPasslessPizazz Is designed to simplify and secure the deployment and configuration of your MFA and/or Passwordless environment. The tool aims to be a facilitator, reducing the complexity inherent in implementing these authentication methods while enhancing their security. With this goal in mind, MfaPasslessPizazz focuses on three key authentication methods, all recognized for their accessibility, reliability, and robust security: Microsoft Authenticator (Password + Push mode): This Microsoft mobile application offers a fast, convenient, and secure way to verify identity when logging into an account or application. The combination of password and push notification for two-factor authentication ensures enhanced security. The user receives a notification on their mobile device and simply needs to approve the authentication request. This provides a high level of security while making authentication quick and easy for the user. TAP (Temporary Access Pass): TAP provides an efficient and flexible way to grant temporary access to a user, which is particularly useful during initial account setup or if the user temporarily loses access to their usual authentication methods. TAP is designed for one-time use and expires after a defined period, making it very secure. FIDO2 Security Key: FIDO2 is an authentication standard that aims to eliminate the use of passwords, thereby increasing security. FIDO2 security keys provide a highly secure two-factor authentication method that is also resistant to phishing. Additionally, they are easy to use and portable, allowing users to carry them wherever they go. This selection enables flexible, secure, and user-friendly multi-factor authentication as well as a transition to Passwordless authentication, meeting both user needs and industry security requirements. MfaPasslessPizazz offers 4 Tools: Update Tool: The central component of MfaPasslessPizazz. The Update Tool manages users within a Microsoft organization, sorting them based on their authentication configuration. It uses conditional controls to allocate users into three distinct groups: MFA_NotConfigured, MFA_Authenticator+FIDO2, and MFA_FIDO2_Passwordless. This distinction allows for efficient management of multi-factor authentication (MFA) and Passwordless configuration. The tool provides comprehensive management for different authentication strategies within a Microsoft environment (multi-factor, Passwordless, or the combination of both). Reset Tool: An essential part of MfaPasslessPizazz that facilitates the reset of user authentication configurations within a Microsoft environment. The tool scans and removes assigned authentication methods for each specified user, enabling a complete reset of authentication, including email authentication, FIDO2, Microsoft Authenticator, phone, Software Oath, and TAP. After the reset, the Reset Tool revokes all active authentication tokens, requiring the user to reconnect to all their applications. Passwordless Tool: The Passwordless Tool is a component of MfaPasslessPizazz that allows a user to transition to Passwordless authentication mode, provided they have already configured a FIDO2 key. The tool removes all other authentication methods for the user and revokes all active tokens. This enforces reconnection using the Passwordless method only, ensuring a secure transition to Passwordless authentication. TAP Management: The TAP (Temporary Access Pass) Management tool in MfaPasslessPizazz is a temporary authentication system that generates one-time-use passwords for users. These temporary passwords can be used when users don't have access to their usual authentication method or during initial configuration for MFA_NotConfigured users. This tool allows you to choose the validity duration of the temporary password, ranging from 10 minutes to 30 days. The TAP is generated for one or more specified users, and the details are exported exclusively to a local CSV file for reference. The tool also provides the ability to remove existing TAPs for one or more users, which is useful for revoking temporary access if no longer needed. User Behavior and Interaction based on Security Groups: MFA_NotConfigured Group: Users are automatically assigned to the MFA_NotConfigured group in the following cases: The user has not configured any authentication method. The user has been processed by the Reset Tool, which resets authentication configurations. If a user is in the MFA_NotConfigured group without TAP, upon their next login, an information window will appear with the following message: "More information required: Your organization requires additional information to maintain account security." The user Is then prompted to follow these steps: Install Microsoft Authenticator on their smartphone. Add a work account using the QR code displayed on the screen. Validate their registration and device by accepting the test login. In the case where the user does not have a smartphone or if you want to directly offer them a Passwordless solution, you can generate a TAP for the user and provide a FIDO2 key. On their next login, the user will be prompted to "Enter the temporary access right." Once connected, the user needs to add their FIDO2 key and/or Microsoft Authenticator to complete the authentication process and enjoy a hybrid MFA/Passwordless solution. This approach provides users with different options to secure their accounts and adapts authentication methods based on their needs and equipment (MFA_PASSWORDLESS procedure included with the tool). MFA_Authenticator+FIDO2 Group: If a user who was previously in the MFA_NotConfigured group configures their Microsoft Authenticator or the FIDO2+Microsoft Authenticator combination, they are automatically moved to the MFA_Authenticator+FIDO2 group. In this group, security is slightly relaxed to ensure a better user experience. When a user is in the MFA_Authenticator+FIDO2 group, they are allowed to bypass additional authentication methods when attempting to log in from defined "trusted" locations. These trusted locations are determined by a list of specified public IP addresses in Named Locations. This approach allows users to benefit from a smoother experience and quicker access to services and applications while maintaining an adequate level of security. MFA_FIDO2_Passwordless Group: Users can be in the MFA_FIDO2_Passwordless group in two scenarios: If the user is initially in the MFA_NotConfigured group, a TAP is generated for them, and they have only added their FIDO2 key. If the user is initially in the MFA_Authenticator+FIDO2 group and goes through the "Passwordless Tool," which removes all authentication methods except FIDO2. In the MFA_FIDO2_Passwordless group, the user enjoys a Passwordless authentication experience, where only their FIDO2 security key is required to access services and applications. This greatly simplifies the authentication process while maintaining a high level of security. However, it is important to note that all applications used by the user must support Passwordless authentication. Some specific applications, such as certain VPN clients using Radius connection, may not be compatible with Passwordless authentication and may require an additional authentication method, such as a push notification. Therefore, it is recommended to check the compatibility of applications with Passwordless authentication before transitioning to the MFA_FIDO2_Passwordless group. This ensures a smooth and secure authentication experience for the user, considering the specific requirements of each application. Configuration and Prerequisites: MfaPasslessPizazz is developed around PowerShell, Microsoft Azure, and Microsoft Graph. By combining Authentication Methods Settings, Authentication Methods Policy, Authentication Strengths, User Registration Details, Conditional Access Policies, Named Locations, and Security Groups, MfaPasslessPizazz conditions the actions of its scripts. As such, certain pre-configurations are required. For this purpose, MfaPasslessPizazz provides an AutoConf module that prepares your environment with just one click! (The only interaction expected is, if desired, entering your list of Safe IP addresses). Finally, before executing the MfaPasslessPizazz tools, as a preemptive measure, you must provide a list of users to be excluded from the various processes. Closing Remarks: MfaPasslessPizazz was designed to simplify and secure MFA and Passwordless authentication deployments in Azure AD environments. In response to the frequent confusion between MFA and Passwordless, as well as the lack of familiarity with the Azure AD environment that can discourage some organizations, I wanted to make the adoption of robust authentication methods more accessible. The primary goal of MfaPasslessPizazz is to facilitate and enhance the security of authentication deployments. To achieve this, I have considered the specific challenges administrators face by providing a solution that ranges from self-configuration to simplified enrollment procedures ready to be shared with end users. You now have a comprehensive set of tools that not only simplify the technical configuration but also improve the end-user experience during their enrollment. Furthermore, I hope that this tool instills the confidence in other administrators to embark on the Azure AD authentication and Graph API adventure. I have taken the time to write clean, organized, and documented scripts to assist adventurous administrators in customizing the tool according to their specific needs. Administrators, feel free to explore the infinite possibilities offered by Azure AD authentication and the Graph API. With MfaPasslessPizazz in your hands, you have a powerful tool to deploy robust and secure authentication methods in your Azure AD environment. Wishing you successful deployments and a rewarding authentication Journey! https://github.com/JCTTTTTTT/MfaPasslessPizazz
Manage M365 MFA setting using Powershell
I am enforcing Multi-Factor Authentication for all my M365 users (azure ad plan 2) and it works as expected. Ability to set exceptions when users work from particular branch offices too works as expected. screenshot below. however, i have many branch offices where the IP address can change every week, so need a way to automate updating the above list. is there a power shell module i can use to update this list rather then login to the portal and type it out every time there is a change ?
MicrosoftTeams cmdlets not working with AccessToken
I am trying to run cmdlets from powershell module MicrosoftTeams (version 2.0.0) in a C# web application. I am using Authorization code flow and code from the answer provided in this post to acquire token: Acquire AAD token using ASP.Net web forms. Note: I had changed resource in the code to graph.windows.net to acquire AAD token. Token is acquired by using AuthenticationContext.AcquireTokenByAuthorizationCodeAsync method. Once the token is acquired, I run the following lines to create a powershell instance in C# and to import MicrosoftTeams Module. PowerShell pshell InitialSessionState iss; iss = InitialSessionState.CreateDefault2(); iss.ImportPSModule(new[] { "MicrosoftTeams" }); pshell = PowerShell.Create(iss); Then to connect with MicrosoftTeams, I run the following code: var connectCmd = new Command("Connect-MicrosoftTeams"); connectCmd.Parameters.Add("AadAccessToken", AccessToken); connectCmd.Parameters.Add("AccountId", "xxxxxxx@xxxxxx.onmicrosoft.com"); pshell.Commands.AddCommand(connectCmd); var result1 = pshell.Invoke(); Code works fine till here. After this I clear the shell commands and invoke the Get-CsTeamsCallingPolicy cmdlet: pshell.Commands.Clear(); pshell.Streams.Error.Clear(); pshell.AddScript("Get-CsTeamsCallingPolicy"); var result2 = pshell.Invoke(); After Invoke, I get an exception and this dialog pops up: Pressing 'Continue' brings back the same dialogue a couple of times. Exception details from this screen are: System.Collections.Generic.KeyNotFoundException was unhandled by user code HResult=-2146232969 Message=The given key was not present in the dictionary. Source=mscorlib StackTrace: at System.Collections.Concurrent.ConcurrentDictionary`2.get_Item(TKey key) at Microsoft.TeamsCmdlets.Powershell.Connect.Models.AzureSessionProvider.GetAccessToken(String resource, IEnumerable`1 scopes) in D:\a\1\s\src\Microsoft.TeamsCmdlets.PowerShell.Connect\Models\AzureSession.cs:line 80 at Microsoft.TeamsCmdlets.Powershell.Connect.TeamsPowerShellSession.GetAccessToken(String resource, IEnumerable`1 scopes) in D:\a\1\s\src\Microsoft.TeamsCmdlets.PowerShell.Connect\TeamsPowerShellSession.cs:line 82 at Microsoft.TeamsCmdlets.PowerShell.Connect.GetCsInternalAccessToken.ProcessRecord() in D:\a\1\s\src\Microsoft.TeamsCmdlets.PowerShell.Connect\GetCsInternalAccessToken.cs:line 61 at System.Management.Automation.CommandProcessor.ProcessRecord() After pressing continue for the 3rd time, control goes back to C# code, and I receive the following runtime exception: Exception calling "GetSteppablePipeline" with "1" argument(s): "Exception calling "GetRemoteNewCsOnlineSession" with "1" argument(s): "Run either Connect-MicrosoftTeams or new-csonlinesession before running cmdlets."" Trying to run this logic from the powershell editor shows similar behavior: Running the following two lines: $AccessToken = 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' Connect-MicrosoftTeams -AadAccessToken $AccessToken -AccountId 'xxxxxxx@xxxxxx.onmicrosoft.com' gives this result: Account Environment Tenant TenantId ------- ----------- ------ -------- xxxxxxx@xxxxxx.onmicrosoft.com AzureCloud xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx I then run Get-Team cmdlet: Get-Team -User xxxxxxx@xxxxxxx.onmicrosoft.com which results in this message: Get-Team : The given key was not present in the dictionary. At line:1 char:1 + Get-Team -User xxxxxxx@xxxxxxx.onmicrosoft.com + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [Get-Team], KeyNotFoundException + FullyQualifiedErrorId : System.Collections.Generic.KeyNotFoundException,Microsoft.TeamsCmdlets.PowerShell.Custom.GetTeam Running cmdlet Get-CsTeamsCallingPolicy yields this: Exception calling "GetSteppablePipeline" with "1" argument(s): "Exception calling "GetRemoteNewCsOnlineSession" with "1" argument(s): "Run either Connect-MicrosoftTeams or new-csonlinesession before running cmdlets."" At C:\Program Files\WindowsPowerShell\Modules\MicrosoftTeams\2.0.0\net472\SfBORemotePowershellModule.psm1:11369 char:13 + $steppablePipeline = $scriptCmd.GetSteppablePipeline($myI ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [], ParentContainsErrorRecordException + FullyQualifiedErrorId : CmdletInvocationException If I run Connect-MicrosoftTeams directly from powershell without providing access token and accountid, I get the login screens and after login everything works fine i.e. I can run Get-Team and Get-CsTeamsCallingPolicy cmdlets successfully but I don't get this behavior when working with AadAccessToken. All the above code works fine if connecting to AzureAD module via Connect-AzureAD cmdlet like this both in web application and powershell editor: Connect-AzureAD -AadAccessToken $AccessToken -AccountId 'xxxxxxx@xxxxxxx.onmicrosoft.com' If someone has faced and successfully resolved this issue or have some tips on how to resolve this, please help. I have already tried a lot of things including searching for the specific exception messages and any possible solutions but found nothing that could help in this particular scenario, installed the latest version of MSTeams module, the previous version was old and did not have all the cmdlets that I am looking to work with. I installed the preview version of MSTeams module also to see if this issue is fixed in the upcoming release. Uninstalled the deprecated SkypeForBuisnessOnline Connector module, updated windows and so on. If you look at Example 4 in the Microsoft documentation for Connect-MicrosoftTeams, this is what I am trying to achieve.
Configure AD FS 2016 and Azure MFA - How do I get the guid for Azure Multi-Factor Auth Client?
Hi All, I am trying to Configure AD FS 2016 and Azure MFA as shown on the Microsoft site: https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-ad-fs-and-azure-mfa#step-1-generate-a-certificate-for-azure-mfa-on-each-ad-fs-server-using-the-new-adfsazuremfatenantcertificate-cmdlet It says "981f26a1-7f43-403b-a875-f8b09b8cd720 is the guid for Azure Multi-Factor Auth Client" but doesn't show how we get this GUID. When I try the command I get an error message I think is related to the GUID. How do I get the guid for Azure Multi-Factor Auth Client? I hope you can help Colinhow to change user status in bulk from mfa enabled to disabled.
how to change user status in bulk from mfa enabled to disabled. i am trying the script below which is not working $users = Import-Csv 'C:\support\BulkUpdateMFASampleFile.csv' foreach ($user in $users) { $st = New-Object -TypeName Microsoft.Online.Administration.StrongAuthenticationRequirement $st.RelyingParty = "*" $st.State = “Enabled” $sta = @($st) Set-MsolUser -UserPrincipalName $user.Username -StrongAuthenticationRequirements $sta }
