Per User Mfa Disable

<# .SYNOPSIS Per-User MFA Disabled (Use Conditional Access) .DESCRIPTION Ensures per-user MFA is disabled in favor of Conditional Access-based MFA .NOTES NL Baseline v2.0 Modern approach: Use Conditional Access instead of per-user MFA #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param([switch]$Monitoring) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Per-User MFA Disabled" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Connect-MgGraph -Scopes "UserAuthenticationMethod.Read.All", "User.Read.All" -ErrorAction Stop -NoWelcome $users = Get-MgUser -All -Property "UserPrincipalName" -Top 100 $result = @{ totalChecked = $users.Count; perUserMfaEnabled = 0; usersWithPerUserMfa = @() } Write-Host " Checking sample of $($result.totalChecked) users..." -ForegroundColor Cyan foreach ($user in $users) { try { $mfaStatus = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/beta/users/$($user.Id)/authentication/requirements" -ErrorAction SilentlyContinue if ($mfaStatus.perUserMfaState -in @('enforced', 'enabled')) { $result.perUserMfaEnabled++ $result.usersWithPerUserMfa += $user.UserPrincipalName } } catch { # Skip users that can't be checked } } Write-Host "`n Summary:" -ForegroundColor Cyan Write-Host " Sampled Users: $($result.totalChecked)" -ForegroundColor White Write-Host " With Per-User MFA: $($result.perUserMfaEnabled)" -ForegroundColor $( if ($result.perUserMfaEnabled -eq 0) { 'Green' }else { 'Yellow' } ) if ($result.perUserMfaEnabled -gt 0) { Write-Host "`n ⚠️ Users with per-user MFA:" -ForegroundColor Yellow $result.usersWithPerUserMfa | Select-Object -First 10 | ForEach-Object { Write-Host " • $_" -ForegroundColor Gray } } Write-Host "`n Modern Approach:" -ForegroundColor Cyan Write-Host " • Use Conditional Access policies" -ForegroundColor Gray Write-Host " • More flexible and secure" -ForegroundColor Gray Write-Host " • Better reporting and controls" -ForegroundColor Gray if ($result.perUserMfaEnabled -eq 0) { Write-Host "`n[OK] COMPLIANT - No per-user MFA found" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - Per-user MFA detected!" -ForegroundColor Red Write-Host "Migrate to Conditional Access-based MFA" -ForegroundColor Yellow exit 1 } } catch { Write-Host "ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } else { Write-Host "Use: -Monitoring" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } function Invoke-Remediation { <# .SYNOPSIS Herstelt de configuratie naar de gewenste staat .DESCRIPTION Dit is een monitoring-only control, remediation delegeert naar monitoring #> [CmdletBinding()] param() Write-Host "[INFO] Dit is een monitoring-only control" -ForegroundColor Yellow Write-Host "[INFO] Running monitoring check..." -ForegroundColor Cyan Invoke-Monitoring }