Self service portal for Azure MFA reset

Reddy, Vasudev Gundam 1

Hi Team,

We have a large number of people who are using Azure, we are enforcing users to use MFA for that we are getting lot of requests to for asking MFA reset because of they changed mobile or different reasons, so we are seeing daily 10 tickets on these.

Is there any way to create self service portal for users can do them self by receiving OTP to work email or any type of authentication?

can you please help me how can we achieve this?

Thanks
Dev

JamesTran-MSFT 36,461 Reputation points Microsoft Employee

2020-08-17T22:06:19.693+00:00

@Reddy, Vasudev Gundam
When you're referencing a self-service portal or a "one-time password", are you asking if there's a place for customer's to update their security info, i.e. a new cell phone number, authentication preferences, etc?

If so, users can access their own My Profile to edit or add verification methods. For more info.

I hope this helps! There's always SSPR if users forget their passwords.
Thank you for your time.
Reddy, Vasudev Gundam 1 Reputation point

2020-08-18T05:03:12.19+00:00

@JamesTran-MSFT Thanks for the reply, I am not asking this when ever user lost or reset his mobile we need to manually clear the MFA metadata in azure by following

1) login to portal
2) search user in active directory
3) select authentication methods of uses profile
4) select Require-reregister MFA to clear user MFA metadata as shown in figure

I have seen few MSonline commands to do those

Connect-MsolService -credential $Credential
$msolUser = Get-MsolUser -UserPrincipalName $UPNToReset
Set-MsolUser -UserPrincipalName $UPNToReset -StrongAuthenticationRequirements @()

but seems its not working as expected, can you please share your taught on this

2 answers

JamesTran-MSFT 36,461 Reputation points Microsoft Employee

2020-08-18T21:37:26.927+00:00

@Reddy, Vasudev Gundam
Thank you for the details in your response! I tested the "require re-register MFA" option within the Portal and found that it does the same thing as this script.

Connect-MsolService -AzureEnvironment AzureCloud
$User = Get-MSolUser -UserPrincipalName "user@mathieu.company .onmicrosoft.com"
$User.StrongAuthenticationMethods
Reset-MsolStrongAuthenticationMethodByUpn -UserPrincipalName "user@mathieu.company .onmicrosoft.com"

Please let me know if you have any issues or other questions.
Thank you for your time!

Reset-MsolStrongAuthenticationMethodByUpn
Please sign in to rate this answer.

3 people found this answer helpful.
vasudeva reddy 41 Reputation points

2020-08-19T07:41:36.007+00:00

@JamesTran-MSFT Thanks for the reply..i have tested with above script which you mentioned, its not worked for me

$User = Get-MSolUser -UserPrincipalName "user@mathieu.company .onmicrosoft.com" -- i am able to fetch user details
$User.StrongAuthenticationMethods -- here when i run this getting empty details

then i have run the below
Reset-MsolStrongAuthenticationMethodByUpn -UserPrincipalName "user@mathieu.company .onmicrosoft.com"

nothing happened to my user its still asking OTP while logging but expected is ask registration again, which not worked as expected also i have checked audit logs on AD i have found nothing with this user

vasudeva reddy 41 Reputation points

2020-08-19T07:50:06.107+00:00

FYI, i have I tested the "require re-register MFA" from portal manually for my normal user and tried to signin its asking to setup MFA which is working fine but only issue with powershell module

$User.StrongAuthenticationMethods --- this i am getting empty hope issue is because of that

JamesTran-MSFT 36,461 Reputation points Microsoft Employee

2020-08-19T21:37:03.96+00:00

@vasudeva reddy
Thank you for the details! Are you getting any error messages? Can you send a screenshot of the OTP screen that you're seeing?

I put in some notes within my screenshot to hopefully help with the process.

-The key point is: when you log in and perform MFA, the "$User.StrongAuthenticationMethods", will have an output. Once you reset your strong auth method, you won't have any output from "$User.StrongAuthenticationMethods", until you login again.

If you're still having issues, please let me know.
Thank you for your time!

Azure ActiveDirectory (MSOnline)

vasudeva reddy 41 Reputation points

2020-08-20T11:20:09.313+00:00

Seems I found the issue, its because of my login credentials i am using it had access to 2 different tenants so its connecting to tenant A and i am resetting user MFA on Tenant B, can you please give suggestion how to use this.

And also is there a way that we can use graph api to do this activity instead powershell modules?

Thanks
Vasudeva Reddy

JamesTran-MSFT 36,461 Reputation points Microsoft Employee

2020-08-20T21:43:53.283+00:00

@vasudeva reddy
Thank you for the follow up! You should be able to run -TenantId "tenantIDInfo" to specify which tenant you want to run the script on.

For more info, you can refer to the Reset-MsolStrongAuthenticationMethodByUpn documentation.

Looking through the MS Graph documentation, I didn't find anything when it comes to resetting the strong authentication method.

If you're still having issues, please let me know!
Thank you for your time and patience throughout this.

----------

If any reply/answer helped resolve your question, please remember to "mark as answer" so that others in the community facing similar issues can easily find the solution.

vasudeva reddy 41 Reputation points

2020-08-21T07:40:04.28+00:00

@JamesTran-MSFT Thanks for the reply

I am still facing issue while using tenant id, when passing tenant-id i am receiving below error

Reset-MsolStrongAuthenticationMethodByUpn : Access Denied. You do not have permissions to call this cmdlet.
At line:1 char:1

Reset-MsolStrongAuthenticationMethodByUpn -UserPrincipalName $UserPri ...

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

CategoryInfo : OperationStopped: (:) [Reset-MsolStron...tionMethodByUpn], MicrosoftOnlineException

FullyQualifiedErrorId : Microsoft.Online.Administration.Automation.AccessDeniedException,Microsoft.Online.Administration.Automation.ResetStrongAuthenticationMethodBy

Thanks
Vasudev

JamesTran-MSFT 36,461 Reputation points Microsoft Employee

2020-08-21T23:12:16.463+00:00

@vasudeva reddy
Thank you for the error details!

From your previous posts, it looks like you're able to sign-in and get user details. However, when you run this command it's saying "You do not have permissions to call this cmdlet." Can you double check you have the correct role assignment/permissions within the correct tenant to run this command; along with making sure the role is active.

For more info: AzureAD Roles

I believe the only three eligible roles to manage MFA would be:
Global Admin
Authentication Admin
Privileged Authentication Admin

Please let me know if you have any other questions.
Thank you again for your time and patience!

vasudeva reddy 41 Reputation points

2020-08-22T07:46:27.53+00:00

@JamesTran-MSFT Thanks a lot for the help so far.

I have solved this issue

issue is because of my user had access to 2 tenants when connecting with connect-Msolservice its taking me to my tenant A where users are synced from on prim, but all our services are on different tenant B for that users are invited from tenant A via invite, now i am doing resets in tenant B where user service name will come as below

username_comapany.com#EXT#@tenant .onmicrosoft.com

so if will search with email it will not found user details because as its invited user UPN name will be different as mentioned above, so what i did is when ever i receive a mail with username@mathieu.company .com it will replace '@' with '_' then using serachstring so that it will fetch the user details and do the job

Now one last question is is there any way to fetch UPN name directly when end user provided email as username@mathieu.company .com ?

Thanks
Vasudev

JamesTran-MSFT 36,461 Reputation points Microsoft Employee

2020-08-24T22:02:52.957+00:00

@vasudeva reddy
When it comes to searching for a user's UPN when they provide their "@mathieu.company .com" email address you can do the following.

Search for the user from the domain list, this will get all users listed under the "@mathieu.company .com" domain:
Get-MsolUser -DomainName "company.com"

You can also refine this search even further by providing a search string for the specific user name:
Get-MsolUser -DomainName "company.com" -SearchString "username001"

For more info: Get-MsolUser

Please let me know if you have any other questions.

----------

If any reply/answer helped resolve your question, please remember to "mark as answer" so that others in the community facing similar issues can easily find the solution.

JamesTran-MSFT 36,461 Reputation points Microsoft Employee

2020-08-25T16:31:51.283+00:00

@vasudeva reddy
I just wanted to check in and see if you had a chance to review my previous post, please let me know if you require further assistance or have any other questions.

Thank you for your time and patience throughout this issue!

----------

If any reply/answer helped resolve your question, please remember to "mark as answer" so that others in the community facing similar issues can easily find the solution.
Sign in to comment
Alexey Klimenko 6 Reputation points

2020-08-18T06:07:45.38+00:00

Sure, it's possible, just follow this guide for deploying - https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfaserver-deploy-userportal
Please sign in to rate this answer.
Reddy, Vasudev Gundam 1 Reputation point

2020-08-18T08:15:57.793+00:00

i want powershell modules to do this

Connect-MsolService -credential $Credential
$msolUser = Get-MsolUser -UserPrincipalName $UPNToReset
Set-MsolUser -UserPrincipalName $UPNToReset -StrongAuthenticationRequirements @()

i found this but no use the link you provided is no use for me
Sign in to comment