14 March 2018

Enable MFA for all Office365 users at once with PowerShell

Now that Multi Factor Authentication is widely supported through all the different PowerShell modules within Office365 and Azure it's a good idea and a best practice to enable MFA for all accounts. Especially admin accounts.

So how do we do this?
After connecting to the MSOnline service with PowerShell run:

$auth = New-Object -TypeName Microsoft.Online.Administration.StrongAuthenticationRequirement            
            
$auth.RelyingParty = "*"            
            
$auth.State = "Enabled"            
            
$auth.RememberDevicesNotIssuedBefore = (Get-Date)            
            
Get-MsolUser –All | Foreach{ Set-MsolUser -UserPrincipalName $_.UserPrincipalName -StrongAuthenticationRequirements $auth}

All users are now "enabled" for MFA.
This should give you a lot of extra brownie points on your secure score rating :-)

No comments:

Post a Comment