System Preferred Mfa

<# .SYNOPSIS System Preferred MFA .DESCRIPTION Enables system-preferred MFA to automatically select the most secure method .NOTES NL Baseline v2.0 #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param([switch]$Monitoring) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "System Preferred MFA" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome $authMethods = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/policies/authenticationMethodsPolicy" $result = @{ systemPreferredEnabled = $false } if ($authMethods.systemCredentialPreferences) { if ($authMethods.systemCredentialPreferences.state -eq 'enabled') { $result.systemPreferredEnabled = $true } } Write-Host " System Preferred MFA: $(if($result.systemPreferredEnabled){'ENABLED'}else{'DISABLED'})" -ForegroundColor $( if ($result.systemPreferredEnabled) { 'Green' }else { 'Yellow' } ) Write-Host "`n Benefits:" -ForegroundColor Cyan Write-Host " • System automatically selects most secure method" -ForegroundColor Gray Write-Host " • Users don't need to choose" -ForegroundColor Gray Write-Host " • Improves security posture" -ForegroundColor Gray Write-Host " • Reduces user friction" -ForegroundColor Gray Write-Host "`n Supported Methods:" -ForegroundColor Cyan Write-Host " • FIDO2 security keys (most secure)" -ForegroundColor Gray Write-Host " • Microsoft Authenticator app" -ForegroundColor Gray Write-Host " • Windows Hello" -ForegroundColor Gray Write-Host " • SMS/Voice (fallback)" -ForegroundColor Gray if ($result.systemPreferredEnabled) { Write-Host "`n[OK] COMPLIANT - System manages MFA automatically" -ForegroundColor Green exit 0 } else { Write-Host "`n⚠️ RECOMMENDED - Enable system-preferred MFA" -ForegroundColor Yellow Write-Host "Configure in: Azure AD > Security > Authentication methods > Settings" -ForegroundColor Gray exit 1 } } catch { Write-Host "ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } else { Write-Host "Use: -Monitoring" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } function Invoke-Remediation { <# .SYNOPSIS Herstelt de configuratie naar de gewenste staat .DESCRIPTION Dit is een monitoring-only control, remediation delegeert naar monitoring #> [CmdletBinding()] param() Write-Host "[INFO] Dit is een monitoring-only control" -ForegroundColor Yellow Write-Host "[INFO] Running monitoring check..." -ForegroundColor Cyan Invoke-Monitoring }