Listen to this Post
Multi-factor authentication (MFA) is a critical security measure for protecting privileged roles in Microsoft Entra ID. This guide explores how to enforce MFA using PowerShell while aligning with CIS benchmarks for compliance.
You Should Know:
1. Verify MFA Status for Privileged Roles
Use PowerShell to check if MFA is enabled for high-privilege accounts:
Connect to Microsoft Graph
Connect-MgGraph -Scopes "User.Read.All", "Policy.Read.All"
List users with privileged roles
$privilegedUsers = Get-MgUser -Filter "assignedLicenses/any(x:x/skuId eq 00000000-0000-0000-0000-000000000004)"
Check MFA status
foreach ($user in $privilegedUsers) {
$mfaStatus = Get-MgUserAuthenticationMethod -UserId $user.Id
Write-Output "$($user.DisplayName) - MFA Enabled: $($mfaStatus.MethodType -contains 'MicrosoftAuthenticator')"
}
2. Enforce MFA via Conditional Access Policy
Create a policy to enforce MFA for privileged roles:
Create a Conditional Access policy
$params = @{
displayName = "Enforce MFA for Privileged Roles"
state = "enabled"
conditions = @{
applications = @{
includeApplications = "All"
}
users = @{
includeRoles = @(
"62e90394-69f5-4237-9190-012177145e10", Global Admin
"194ae4cb-b126-40b2-bd5b-6091b380977d" Security Admin
)
}
}
grantControls = @{
operator = "OR"
builtInControls = @("mfa")
}
}
New-MgIdentityConditionalAccessPolicy -BodyParameter $params
3. Audit MFA Compliance with CIS Benchmarks
Ensure alignment with CIS Microsoft 365 Foundation Benchmark (v1.5.0):
Export MFA report for compliance Get-MgReportAuthenticationMethodUserRegistrationDetail | Export-Csv -Path "MFA_Compliance_Report.csv" -NoTypeInformation
4. Automate Remediation for Non-Compliant Users
Disable non-compliant admin accounts:
$nonCompliantUsers = Get-MgUser -Filter "assignedLicenses/any(x:x/skuId eq 00000000-0000-0000-0000-000000000004)" |
Where-Object { (Get-MgUserAuthenticationMethod -UserId $_.Id).MethodType -notcontains "MicrosoftAuthenticator" }
foreach ($user in $nonCompliantUsers) {
Update-MgUser -UserId $user.Id -AccountEnabled:$false
Write-Output "Disabled $($user.DisplayName) for MFA non-compliance"
}
5. Linux/Mac Alternative (via Azure CLI)
For cross-platform teams:
az login
az ad user list --query "[?assignedLicenses[?skuId=='00000000-0000-0000-0000-000000000004']].{Name:displayName, MFAEnabled:strongAuthenticationRequirements.state}" --output table
What Undercode Say:
Enforcing MFA for privileged roles is non-negotiable in modern security frameworks. By automating checks and remediation with PowerShell, organizations can:
– Reduce attack surfaces by 99% for credential-based attacks (Microsoft, 2025)
– Achieve CIS Benchmark compliance for identity security controls
– Enable real-time monitoring through Graph API integrations
Prediction:
As identity threats evolve, expect Microsoft to:
- Roll out AI-driven MFA bypass detection by Q3 2025
- Integrate Entra ID MFA logs directly into Defender XDR
3. Mandate phishing-resistant authentication (FIDO2/WebAuthn) for Global Admins
Expected Output:
Global Admin - MFA Enabled: True Security Admin - MFA Enabled: False → Remediation required Conditional Access Policy "Enforce MFA for Privileged Roles" created successfully
Reference: Jon Milner’s Blog
IT/Security Reporter URL:
Reported By: Beingageek Awesomeblogs – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
