Skip to content

Commit c744850

Browse files
JohnDupreyJohnDuprey
committed
Add MFA reset back in
1 parent ed0d2ec commit c744850

3 files changed

Lines changed: 69 additions & 33 deletions

File tree

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECRemediate.ps1‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,9 @@ Function Invoke-ExecBECRemediate {
2727
$Step = 'Disable Account'
2828
Set-CIPPSignInState -userid $username -AccountEnabled $false -tenantFilter $TenantFilter -APIName $APINAME -ExecutingUser $User
2929
$Step = 'Revoke Sessions'
30-
Revoke-CIPPSessions -userid $SuspectUser -username $request.body.username -ExecutingUser $User -APIName $APINAME -tenantFilter $TenantFilter
31-
30+
Revoke-CIPPSessions -userid $SuspectUser -username $username -ExecutingUser $User -APIName $APINAME -tenantFilter $TenantFilter
31+
$Step = 'Remove MFA methods'
32+
Remove-CIPPUserMFA -UserPrincipalName $username -TenantFilter $TenantFilter -ExecutingUser $User
3233
$Step = 'Disable Inbox Rules'
3334
$Rules = New-ExoRequest -anchor $username -tenantid $TenantFilter -cmdlet 'Get-InboxRule' -cmdParams @{Mailbox = $username; IncludeHidden = $true }
3435
$RuleDisabled = 0

‎Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecResetMFA.ps1‎

Lines changed: 1 addition & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -17,37 +17,7 @@ Function Invoke-ExecResetMFA {
1717
$TenantFilter = $Request.Query.TenantFilter
1818
$UserID = $Request.Query.ID
1919
try {
20-
Write-Host "Getting auth methods for $UserID"
21-
$AuthMethods = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users/$UserID/authentication/methods" -tenantid $TenantFilter -AsApp $true
22-
$Requests = [System.Collections.Generic.List[object]]::new()
23-
foreach ($Method in $AuthMethods) {
24-
if ($Method.'@odata.type' -and $Method.'@odata.type' -ne '#microsoft.graph.passwordAuthenticationMethod') {
25-
$MethodType = ($Method.'@odata.type' -split '\.')[-1] -replace 'Authentication', ''
26-
$Requests.Add(@{
27-
id = "$MethodType-$($Method.id)"
28-
method = 'DELETE'
29-
url = ('users/{0}/authentication/{1}s/{2}' -f $UserID, $MethodType, $Method.id)
30-
})
31-
}
32-
}
33-
if (($Requests | Measure-Object).Count -eq 0) {
34-
$Results = [pscustomobject]@{'Results' = "No MFA methods found for user $($Request.Query.ID)" }
35-
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
36-
StatusCode = [HttpStatusCode]::OK
37-
Body = $Results
38-
})
39-
return
40-
}
41-
42-
$Results = New-GraphBulkRequest -Requests $Requests -tenantid $TenantFilter -asapp $true -erroraction stop
43-
44-
45-
if ($Results.status -eq 204) {
46-
$Results = [pscustomobject]@{'Results' = "Successfully completed request. User $($Request.Query.ID) must supply MFA at next logon" }
47-
} else {
48-
$FailedAuthMethods = (($Results | Where-Object { $_.status -ne 204 }).id -split '-')[0] -join ', '
49-
$Results = [pscustomobject]@{'Results' = "Failed to reset MFA methods for $FailedAuthMethods" }
50-
}
20+
$Results = Remove-CIPPUserMFA -UserPrincipalName $UserID -TenantFilter $TenantFilter -ExecutingUser $request.headers.'x-ms-client-principal'
5121
} catch {
5222
$Results = [pscustomobject]@{'Results' = "Failed to reset MFA methods for $($Request.Query.ID): $(Get-NormalizedError -message $_.Exception.Message)" }
5323
Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -message "Failed to reset MFA for user $($Request.Query.ID): $($_.Exception.Message)" -Sev 'Error' -LogData (Get-CippException -Exception $_)

‎Modules/CIPPCore/Public/Remove-CIPPUserMFA.ps1‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
function Remove-CIPPUserMFA {
2+
<#
3+
.SYNOPSIS
4+
Remove MFA methods for a user
5+
6+
.DESCRIPTION
7+
Remove MFA methods for a user using bulk requests to the Microsoft Graph API
8+
9+
.PARAMETER UserPrincipalName
10+
UserPrincipalName of the user to remove MFA methods for
11+
12+
.PARAMETER TenantFilter
13+
Tenant where the user resides
14+
15+
.EXAMPLE
16+
Remove-CIPPUserMFA -UserPrincipalName testuser@contoso.com -TenantFilter contoso.com
17+
18+
#>
19+
[CmdletBinding(SupportsShouldProcess = $true)]
20+
Param(
21+
[Parameter(Mandatory = $true)]
22+
[string]$UserPrincipalName,
23+
[Parameter(Mandatory = $true)]
24+
[string]$TenantFilter,
25+
[Parameter(Mandatory = $false)]
26+
[string]$ExecutingUser = 'CIPP'
27+
)
28+
29+
Write-Information "Getting auth methods for $UserPrincipalName"
30+
$AuthMethods = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users/$UserPrincipalName/authentication/methods" -tenantid $TenantFilter -AsApp $true
31+
$Requests = [System.Collections.Generic.List[object]]::new()
32+
foreach ($Method in $AuthMethods) {
33+
if ($Method.'@odata.type' -and $Method.'@odata.type' -ne '#microsoft.graph.passwordAuthenticationMethod') {
34+
$MethodType = ($Method.'@odata.type' -split '\.')[-1] -replace 'Authentication', ''
35+
$Requests.Add(@{
36+
id = "$MethodType-$($Method.id)"
37+
method = 'DELETE'
38+
url = ('users/{0}/authentication/{1}s/{2}' -f $UserPrincipalName, $MethodType, $Method.id)
39+
})
40+
}
41+
}
42+
if (($Requests | Measure-Object).Count -eq 0) {
43+
Write-LogMessage -API 'Remove-CIPPUserMFA' -tenant $TenantFilter -message "No MFA methods found for user $UserPrincipalName" -sev 'Info'
44+
$Results = [pscustomobject]@{'Results' = "No MFA methods found for user $($Request.Query.ID)" }
45+
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
46+
StatusCode = [HttpStatusCode]::OK
47+
Body = $Results
48+
})
49+
return
50+
}
51+
52+
if ($PSCmdlet.ShouldProcess("Remove MFA methods for $UserPrincipalName")) {
53+
$Results = New-GraphBulkRequest -Requests $Requests -tenantid $TenantFilter -asapp $true -erroraction stop
54+
if ($Results.status -eq 204) {
55+
Write-LogMessage -API 'Remove-CIPPUserMFA' -tenant $TenantFilter -message "Successfully removed MFA methods for user $UserPrincipalName" -sev 'Info'
56+
$Results = [pscustomobject]@{'Results' = "Successfully completed request. User $($Request.Query.ID) must supply MFA at next logon" }
57+
} else {
58+
$FailedAuthMethods = (($Results | Where-Object { $_.status -ne 204 }).id -split '-')[0] -join ', '
59+
Write-LogMessage -API 'Remove-CIPPUserMFA' -tenant $TenantFilter -message "Failed to remove MFA methods for $FailedAuthMethods" -sev 'Error'
60+
$Results = [pscustomobject]@{'Results' = "Failed to reset MFA methods for $FailedAuthMethods" }
61+
}
62+
}
63+
64+
return $Results
65+
}

0 commit comments

Comments
 (0)