Can Azure MFA be managed through Adaxes

Question

We utilize Azure AD as well as Azure MFA for our VPN and we have instances where the MFA needs to be reset (essentially revoked then require to re-register). This link shows basically what we need to do.

https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userdevicesettings

Currently only our sysadmins can do this, but we would like to extend this to our Helpdesk techs which unfortunately requires giving full access to Azure AD. We would like to leverage Adaxes for this, but not sure if it is possible or how it would be done.

Answer 1

Hello,

It can be done using the Reset MFA script from the following article in our repository: https://www.adaxes.com/script-repository/enabledisable-multi-factor-authentication-for-a-user-in-office-365-s544.htm.

Comments

Where did the mfa reset script go? It's not in the repository anymore. Is there another way to reset Azure MFA for users?

---

Hello,

Where did the mfa reset script go? It's not in the repository anymore.

The script was removed due to the changes in the API made by Microsoft.

Is there another way to reset Azure MFA for users?

The only option is to use a script. Unfortunately, we do not have all the examples as there is no full documentation provided by Microsoft. We can only state that is should be done via MgGraph. The folowing example should be helpful: https://www.adaxes.com/script-repository/enable-mfa-with-phone-number-for-a-user-in-microsoft-365-s686.htm.

---

I have this script for MFA Reset and seems to work for me at least, if Support could verify. Needs Microsoft Graph installed like M365 Signout script (https://www.adaxes.com/script-repository/sign-out-from-all-microsoft-365-services-s597.htm)

$azureId = $Context.TargetObject.AzureID

if ($NULL -eq $azureId) {
    $Context.LogMessage("User %fullname% does not have an Azure AD account.", "Warning")
    return
}

$accessToken = $Context.CloudServices.GetAzureAuthAccessToken()
Connect-MgGraph -AccessToken ($accessToken | ConvertTo-SecureString -AsPlainText -Force)

#Search for Authenticator App methods and remove any found
$App = Get-MgUserAuthenticationMicrosoftAuthenticatorMethod -UserId $azureId
if ($App) {
    $App | ForEach-Object {
        Remove-MgUserAuthenticationMicrosoftAuthenticatorMethod -UserId $azureId -MicrosoftAuthenticatorAuthenticationMethodId $_.Id
        $Context.LogMessage("Authenticator App '$(($_.DisplayName))' removed for user $azureId.", "Information")
    }
} else {
    $Context.LogMessage("No Authenticator App methods found for user $azureId.", "Information")
}

#Search for Email methods and remove any found
$Email = Get-MgUserAuthenticationEmailMethod -UserId $azureId
if ($Email) {
    $Email | ForEach-Object {
        Remove-MgUserAuthenticationEmailMethod -UserId $azureId -EmailAuthenticationMethodId $_.Id
        $Context.LogMessage("Email address '$(($_.EmailAddress))' removed for user $azureId.", "Information")
    }
} else {
    $Context.LogMessage("No Email methods found for user $azureId.", "Information")
}

#Search for Phone methods and remove any found
$Phone = Get-MgUserAuthenticationPhoneMethod -UserId $azureId
if ($Phone) {
    $Phone | ForEach-Object {
        Remove-MgUserAuthenticationPhoneMethod -UserId $azureId -PhoneAuthenticationMethodId $_.Id
        $Context.LogMessage("Phone number '$(($_.PhoneNumber))' removed for user $azureId.", "Information")
    }
} else {
    $Context.LogMessage("No Phone/Text methods found for user $azureId.", "Information")
}

---

Hello,

Unfortunately, we are not able to actually verify the script due to the lack of documentation from Microsoft after bringing the functionality to Microsoft graph instead of MSOnline. However, if you see it working, then it should be just fine.

---

Thank you for this, pbug! I've tested your script and it works, I adapted it to my own needs to also include Software OATH token methods. Only issue that I found that if one of the users authentication methods is set to their default method, and there are other methods present then it won't remove them.