Script Powershell for MFA call - powershell

Question

I'm having trouble running this script. I am supposed to call using Strong authentication requirements which means users that enabled MFA using the MFA portal will be displayed if I am not mistaken.
Connect-MsolService
$role = getMsolRole -rolename "Company Administrator"
$rm = get-MsolRoleMember -RoleObjectId $role.ObjectId
foreach ($c in $rm)
{
Get-MsolUser -UserPrincipalName $c.EmailAddress | Select DisplayName, UserPrincipalName, #{N="MFA Status"; E={ if($_.StrongAuthenticationRequirements.Count -ne 0) { $_.StrongAuthenticationRequirements.State.toString() } else 'Disabled' }}
Error is
At line:9 char:225
+ ... { $_.StrongAuthenticationRequirements.State.toString() } else 'Disabl ...
+ ~
Missing statement block after 'else' keyword.
+ CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordException
+ FullyQualifiedErrorId : MissingStatementBlockAfterElse
Edited:
If even you can clarify the difference between calling MFA using StrongAuthenticationMethods and using StrongAuthenticationRequirements that will be good. So I can reproduce this code.
Problem with our MFA audit code is that it displays that system administrators are having MFA disabled even though they are claiming they are already enabled.
This is the audit code which returns admins with wildcard administrator are disabled.
Function Get-O365AdminMFAStatus{
$AdminData=#()
$objRole=#()
$Domain = $(get-addomain).dnsroot
$Log = "C:\temp\Audit\$Domain O365 Admin MFA Status $(get-date -f yyyy-MM-dd).csv"
try{
$Roles = Get-MsolRole | where {$_.name -LIKE "*Administrator*"}
$Roles = ($Roles).name
foreach ($Role in $Roles){
$Members = Get-MsolRoleMember -RoleObjectId (Get-MsolRole -RoleName $Role).ObjectId
foreach ($Member in $Members){
$MsUser = $Member | Get-MsolUser
if($MsUser.StrongAuthenticationMethods.Count -eq 0) {
$Enabled = "False"
write-host $Role - $Member.DisplayName "No MFA enabled" -foregroundcolor red
}
Else{
$Enabled = "True"
write-host $Role - $Member.DisplayName "MFA enabled" -foregroundcolor green
}
Try{
$Exist = [bool](Get-mailbox $MsUser.UserPrincipalName -erroraction SilentlyContinue)
if ($Exist){
$MBStats = Get-MailboxStatistics $MsUser.UserPrincipalName
$LastLogon = $MBstats.LastLogonTime
}
Else{
$LastLogon = "N/A"
}
}
Catch{
$LastLogon = "N/A"
}
$objRole = New-Object -TypeName PSObject
$objRole | Add-Member -MemberType NoteProperty -Name "Role Name" -Value $Role
$objRole | Add-Member -MemberType NoteProperty -Name "Display Name" -Value $Member.DisplayName
$objRole | Add-Member -MemberType NoteProperty -Name "UPN" -Value $Member.UserPrincipalName
$objRole | Add-Member -MemberType NoteProperty -Name "Licensed" -Value $Member.IsLicensed
$objRole | Add-Member -MemberType NoteProperty -Name "Last Logon" -Value $LastLogon
$objRole | Add-Member -MemberType NoteProperty -Name "MFA Enabled?" -Value $Enabled
$AdminData += $objRole
}
}
$AdminData | Export-Csv -NoTypeInformation $Log
write-host ""
write-host "CSV Export Complete to $Log" -foregroundcolor yellow
}
Catch{
Write-host "There was an error: $($_.Exception.Message)"
}
}
Get-O365AdminMFAStatus
anyways if you have clarifications with the question I will edit.

Answer 1

From the error you receive it's quite obvious, what you should correct:
Missing statement block after 'else' keyword
You're missing curly braces after else so it should be:
else {'Disabled'}
I checked your cmdlet against my accounts (I have 2FA enabled) and StrongAuthenticationRequirements is empty object for me (checked on many accounts - attempt to clarify below). I think that you should use StrongAuthenticationMethods property instead. It contains information about channels that were configured for 2FA.
Finally, your code would look like this:
foreach ($c in $rm) {
Get-MsolUser -UserPrincipalName $c.EmailAddress | Select DisplayName, UserPrincipalName,
#{N="MFA Status"; E={ if($_.StrongAuthenticationMethods.Count -ne 0) { "$($_.StrongAuthenticationMethods.Count) methods found" } else {'Disabled'} }}
}
But you might notice some entries erroring with such info:
Get-MsolUser : Cannot bind argument to parameter 'UserPrincipalName' because it is null.
To get rid of that, important thing is to filter out ServicePrincipal members from Get-MsolRoleMember (for example, I have RMS and PowerBI Information Service, you might have none or different ones):
foreach ($c in $rm | Where-Object {$_.rolemembertype -eq 'user'}) {
Get-MsolUser -UserPrincipalName $c.EmailAddress | Select DisplayName, UserPrincipalName,
#{N="MFA Status"; E={ if($_.StrongAuthenticationMethods.Count -ne 0) { "$($_.StrongAuthenticationMethods.Count) methods found" } else {'Disabled'} }}
}
Clarification about StrongAuthenticationMethods and StrongAuthenticationRequirements
From what I read here it seems like StrongAuthenticationRequirements applies for per-user MFA. If your tenant is using Conditional Access based MFA, that property might be empty (checked on my tenant). So I guess StrongAuthenticationMethods is more reliable.
NOTE: I also tested the part of long code you have posted and it works correctly for me. And you have a typo in getMsolRole - should be Get-MsolRole