Change default Multifactor with Microsoft Graph PowerShell

Many of my customers have been using Entra ID (Azure Active Directory) MFA for ages. The problem for many of the early adopters is that many users enrolled to use SMS as the default method. Even if they have run campaigns and adoption events, some users just wont change. Some manage to configure the Authenticator app but skip to change the method to default, and keep using SMS. Previously, admins were unable to change the default MFA method. But now there is a change!

Now you can, as an admin, change the default Entra ID MFA method both in Admin portal and in Microsoft Graph!

This blog focus on Microsoft Graph way of changing the default MFA method.

Change default MFA method using graph

First you need to install microsoft graph module

install-module microsoft.graph
import-module microsoft.graph

Then you need to connect to graph. For this to work you will need the following permissions:

• UserAuthenticationMethod.ReadWrite.All
• User.Read.All

If you run this you will get a prompt to consent the permissions if using it for the first time

Connect-MgGraph -scopes "User.Read.All,UserAuthenticationMethod.ReadWrite.All"

Lets get the user to change the default method for

$MgUser = Get-MgUser -UserId "mr.tbone@tbone.se"

There is no ready command to set the default MFA method, so you need to send a graph request to Patch the setting for the user. The graph URI to Patch is this:

$uri = “https://graph.microsoft.com/beta/users/$($MgUser.id)/authentication/signInPreferences”

On this URI I have found 3 interesting properties: we can set 2 properties:

• systemPreferredAuthenticationMethod – The System-preferred multifactor authentication selected by the global setting
• isSystemPreferredAuthenticationMethodEnabled – determine if System-preferred multifactor authentication should be enforced on this user
• userPreferredMethodForSecondaryAuthentication – The default auth method selected by user or set by admin

Read more on System-preferred multifactor authentication – Authentication methods policy HERE

To get the current values for the user, we can use the same URI and post a GET

Invoke-MgGraphRequest -uri $uri -Method GET

The result could look like this:

The different MFA methods you can push into the users default setting are:

• push – push notification in Microsoft Authenticator
• oath – 6 digit code from authentication app.
• voiceMobile – Microsoft call upp your primary mobile phone
• voiceAlternateMobile – Microsoft call upp your alternate mobile phone
• voiceOffice – Microsoft call upp your office phone
• sms – 6 digit code from SMS text message to the mobile phone

As you can see there are some methods missing, but might appear in later updates.

We take the method we want to set as default and build a body to attach to the Patch:

$body = @’
{“userPreferredMethodForSecondaryAuthentication”: “push”}
‘@

If we do not want System-preferred multifactor authentication to be enforced we can also add that property:

$body = @’
{“isSystemPreferredAuthenticationMethodEnabled”: false
“userPreferredMethodForSecondaryAuthentication”: “push”}
‘@

The result can look like this:

If we then request the settings with GET we can verify the result:

Change Default MFA method on all users

I have written a script to set the users default method to the specified one.
It will fist check if the user is compliant to use that method by getting the registered methods for each user.

Script can be found on my GITHUB

<#PSScriptInfo
.SYNOPSIS
    Script to set Default Password

.DESCRIPTION
    This script will set the default MFA method for a specific user of for all users in the tenant to the preferred method defined in the script.
        
.EXAMPLE
    .\set-MFADefaultMethod.ps1
    Will set the default MFA method for all users in the tenant to the preferred method defined in the script.
    .\set-MFADefaultMethod.ps1 -UserPrincipalName mr.tbone@tbone.se
    Will set the default MFA method for the specified user

.NOTES
    Written by Mr-Tbone (Tbone Granheden) Coligo AB
    torbjorn.granheden@coligo.se

.VERSION
    1.0

.RELEASENOTES
    1.0 2023-09-18 Initial Build
.AUTHOR
    Tbone Granheden 
    @MrTbone_se

.COMPANYNAME 
    Coligo AB

.GUID 
    00000000-0000-0000-0000-000000000000

.COPYRIGHT
    Feel free to use this, But would be grateful if My name is mentioned in Notes 

.CHANGELOG
    1.0.2309.1 - Initial Version   
#>

#region ---------------------------------------------------[Set script requirements]-----------------------------------------------
#Requires -Version 7.0
#endregion

#region ---------------------------------------------------[Script Parameters]-----------------------------------------------
param(
  [Parameter(
    Mandatory = $false,
    ParameterSetName  = "UserPrincipalName",
    HelpMessage = "Enter a single UserPrincipalName",
    Position = 0
    )]
  [string[]]$UserPrincipalName
)
#endregion

#region ---------------------------------------------------[Modifiable Parameters and defaults]------------------------------------
$UserDefaultMethod = "push" # Set the preferred MFA method here
$SystemPreferredMethodEnabled = "true" # Set to true if you want to enable the system preferred authentication method
#endregion

#region ---------------------------------------------------[Set global script settings]--------------------------------------------
Set-StrictMode -Version Latest
#endregion

#region ---------------------------------------------------[Static Variables]------------------------------------------------------
$AllMgUsers       = @()

#Log File Info
#endregion

#region ---------------------------------------------------[Import Modules and Extensions]-----------------------------------------
Import-Module Microsoft.Graph.users
Import-Module Microsoft.Graph.Authentication
#endregion

#region ---------------------------------------------------[Functions]------------------------------------------------------------
#endregion

#region ---------------------------------------------------[[Script Execution]------------------------------------------------------

# Connect to Graph
Connect-MgGraph -scopes "User.Read.All,UserAuthenticationMethod.ReadWrite.All" -NoWelcome

if ($UserPrincipalName) {$AllMgUsers += Get-MgUser -UserId $UserPrincipalName}
else{$AllMgUsers = Get-MgUser -Filter "userType eq 'Member'"  -all}
$TotalMgUsers = $AllMgUsers.Count

# Get all the user's authentication methods. Batches is faster than getting the user and then the methods
$starttime = get-date
$AllAuthMethods = @()
for($i=0;$i -lt $TotalMgUsers;$i+=20){
    $req = @{}                
    # Use select to create hashtables of id, method and url for each call                                     
    if($i + 19 -lt $TotalMgUsers){
        $req['requests'] = ($AllMgUsers[$i..($i+19)] 
            | select @{n='id';e={$_.id}},@{n='method';e={'GET'}},`
            @{n='url';e={"/users/$($_.id)/authentication/methods"}})
    } else {
        $req['requests'] = ($AllMgUsers[$i..($TotalMgUsers-1)] 
            | select @{n='id';e={$_.id}},@{n='method';e={'GET'}},`
            @{n='url';e={"/users/$($_.id)/authentication/methods"}})
    }
    $response = invoke-mggraphrequest -Method POST `
        -URI "https://graph.microsoft.com/beta/`$batch" `
        -body ($req | convertto-json)
    $CurrentMgUser = $i  
    $response.responses | foreach {
        if($_.status -eq 200 -and $_.body.value -ne $null){
            $AuthMethod  = [PSCustomObject]@{
                "userprincipalname" = $AllMgUsers[$CurrentMgUser].userPrincipalName
                "AdditionalProperties" = $_.body
            }
            $AllAuthMethods += $AuthMethod
        } else {
            # request failed
            #write-host "the request for signInPreference failed"
        }
        $CurrentMgUser++
    }
#progressbar
    $Elapsedtime = (get-date) - $starttime
    $timeLeft = [TimeSpan]::FromMilliseconds((($ElapsedTime.TotalMilliseconds / $CurrentMgUser) * ($TotalMgUsers - $CurrentMgUser)))
    Write-Progress -Activity "Getting Authentication Methods for users $($CurrentMgUser) of $($TotalMgUsers)" `
        -Status "Est Time Left: $($timeLeft.Hours) Hours, $($timeLeft.Minutes) Minutes, $($timeLeft.Seconds) Seconds" `
        -PercentComplete $([math]::ceiling($($CurrentMgUser / $TotalMgUsers) * 100))
}

# Build the JSON Body request
$body = @'
{
    "isSystemPreferredAuthenticationMethodEnabled": SystemPreferredMethodEnabled,
    "userPreferredMethodForSecondaryAuthentication": "UserDefaultMethod"
}
'@
$body = $body -replace 'SystemPreferredMethodEnabled', $SystemPreferredMethodEnabled
$body = $body -replace 'UserDefaultMethod', $UserDefaultMethod

#Start the loop to set the default method for each user
$CurrentMgUser = 0
$starttime = get-date
foreach($MgUser in $AllMgUsers){
#Reset all the variables 
    $Authenticator = $false
    $Phone = $false
    $PasswordLess = $false
    $Fido2 = $false
    $TAP = $false
    $WHFB = $false
    $3part = $false
    $Email = $false

    $uri = "https://graph.microsoft.com/beta/users/$($Mguser.id)/authentication/signInPreferences"
#Get the current setting, if it matches the preferred method, do nothing, else set the preferred method
    $CurrentDefaults = Invoke-MgGraphRequest -uri $uri -Method GET -OutputType PSObject
    If ($CurrentDefaults.userPreferredMethodForSecondaryAuthentication -eq $UserDefaultMethod){}
    else{
        #Get the user's authentication methods
        $mfaData = $AllAuthMethods | where userprincipalname -eq $mguser.UserPrincipalName | select -ExpandProperty AdditionalProperties
        # Populate $userobject with MFA methods from $mfaData
        if ($mfaData) {
            ForEach ($method in $mfaData.value) {
                Switch ($method['@odata.type']) {
                    "#microsoft.graph.microsoftAuthenticatorAuthenticationMethod" {
                        # Microsoft Authenticator App
                        $Authenticator = $true
                    }
                    "#microsoft.graph.phoneAuthenticationMethod" {
                        # Phone authentication
                        $Phone = $true
                    }
                    "#microsoft.graph.passwordlessMicrosoftAuthenticatorAuthenticationMethod" {
                        # Passwordless
                        $PasswordLess = $true
                    }
                    "#microsoft.graph.fido2AuthenticationMethod" {
                        # FIDO2 key
                        $Fido2 = $true
                    }
                    "microsoft.graph.temporaryAccessPassAuthenticationMethod" {
                        # Temporary Access pass
                        $TAP = $true
                    }
                    "#microsoft.graph.windowsHelloForBusinessAuthenticationMethod" {
                        # Windows Hello
                        $WHFB = $true
                    }
                    "#microsoft.graph.softwareOathAuthenticationMethod" {
                        # ThirdPartyAuthenticator
                        $3part = $true
                    }
                    "#microsoft.graph.emailAuthenticationMethod" {
                        # Email Authentication
                        $Email = $true
                    }
                }
            }
        }
        #Set the default method if the user has a registered method that matches the preferred method
        If ((($UserDefaultMethod -eq "push") -or ($UserDefaultMethod -eq "oath"))-and ($Authenticator -eq $true))
            {
            Invoke-MgGraphRequest -uri $uri -Body $body -Method PATCH
        }
        elseIf ((($UserDefaultMethod -eq "phone") -or ($UserDefaultMethod -eq "voiceMobile") -or ($UserDefaultMethod -eq "voiceAlternateMobile") -or ($UserDefaultMethod -eq "voiceOffice") -or ($UserDefaultMethod -eq "sms")) -and ($Phone -eq $true))
            {
            Invoke-MgGraphRequest -uri $uri -Body $body -Method PATCH
        }
        else{
            #User has no registered method that matches the preferred method
        }
    }
    $CurrentMgUser++
    
    #progressbar
    if($CurrentMgUser % 100 -eq 0){
        $Elapsedtime = (get-date) - $starttime
        $timeLeft = [TimeSpan]::FromMilliseconds((($ElapsedTime.TotalMilliseconds / $CurrentMgUser) * ($TotalMgUsers - $CurrentMgUser)))
        Write-Progress -Activity "Getting Authentication Methods for users $($CurrentMgUser) of $($TotalMgUsers)" `
            -Status "Est Time Left: $($timeLeft.Hours) Hours, $($timeLeft.Minutes) Minutes, $($timeLeft.Seconds) Seconds" `
            -PercentComplete $([math]::ceiling($($CurrentMgUser / $TotalMgUsers) * 100))
        }
}
Disconnect-Graph
#endregion

About The Author