MFA Migration: Okta to Entra ID¶

# Enable combined registration
$params = @{
    registrationEnforcement = @{
        authenticationMethodsRegistrationCampaign = @{
            snoozeDurationInDays = 3
            state = "enabled"
            excludeTargets = @()
            includeTargets = @(
                @{
                    id = "all_users"
                    targetType = "group"
                    targetedAuthenticationMethod = "microsoftAuthenticator"
                }
            )
        }
    }
}

Update-MgPolicyAuthenticationMethodPolicy -BodyParameter $params

# Issue Temporary Access Pass for MFA enrollment
$tapParams = @{
    startDateTime = (Get-Date).ToString("yyyy-MM-ddTHH:mm:ssZ")
    lifetimeInMinutes = 60
    isUsableOnce = $true
}

New-MgUserAuthenticationTemporaryAccessPassMethod -UserId "user@contoso.com" -BodyParameter $tapParams

# Configure Microsoft Authenticator authentication method
$authenticatorConfig = @{
    "@odata.type" = "#microsoft.graph.microsoftAuthenticatorAuthenticationMethodConfiguration"
    state = "enabled"
    includeTargets = @(
        @{
            targetType = "group"
            id = "all_users"
            authenticationMode = "any"  # push, passwordless, or both
        }
    )
    featureSettings = @{
        displayAppInformationRequiredState = @{
            state = "enabled"  # Show app name in push notification
        }
        displayLocationInformationRequiredState = @{
            state = "enabled"  # Show location in push notification
        }
        numberMatchingRequiredState = @{
            state = "enabled"  # Require number matching (phishing-resistant)
        }
    }
}

# Apply configuration
Update-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `
    -AuthenticationMethodConfigurationId "MicrosoftAuthenticator" `
    -BodyParameter $authenticatorConfig

# Enable FIDO2 authentication method
$fido2Config = @{
    "@odata.type" = "#microsoft.graph.fido2AuthenticationMethodConfiguration"
    state = "enabled"
    isAttestationEnforced = $true  # Require attestation for key type verification
    isSelfServiceRegistrationAllowed = $true
    keyRestrictions = @{
        isEnforced = $true
        enforcementType = "allow"
        aaGuids = @(
            "2fc0579f-8113-47ea-b116-bb5a8db9202a",  # YubiKey 5 NFC
            "73bb0cd4-e502-49b8-9c6f-b59445bf720b",  # YubiKey 5Ci
            "cb69481e-8ff7-4039-93ec-0a2729a154a8"   # YubiKey 5 series
        )
    }
    includeTargets = @(
        @{
            targetType = "group"
            id = "all_users"
        }
    )
}

Update-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `
    -AuthenticationMethodConfigurationId "Fido2" `
    -BodyParameter $fido2Config

# Create Conditional Access policy requiring MFA for all users
$caPolicy = @{
    displayName = "Require MFA for all users"
    state = "enabledForReportingButNotEnforced"  # Start in report-only mode
    conditions = @{
        users = @{
            includeUsers = @("All")
            excludeUsers = @()
            excludeGroups = @("break-glass-accounts")
        }
        applications = @{
            includeApplications = @("All")
        }
        clientAppTypes = @("browser", "mobileAppsAndDesktopClients")
    }
    grantControls = @{
        operator = "OR"
        builtInControls = @("mfa")
    }
}

New-MgIdentityConditionalAccessPolicy -BodyParameter $caPolicy

# After validation, change state to "enabled"

# Require phishing-resistant MFA for sensitive applications
$prMfaPolicy = @{
    displayName = "Require phishing-resistant MFA for sensitive apps"
    state = "enabled"
    conditions = @{
        users = @{
            includeUsers = @("All")
        }
        applications = @{
            includeApplications = @(
                "fabric-workspace-app-id",
                "azure-portal-app-id",
                "admin-console-app-id"
            )
        }
    }
    grantControls = @{
        operator = "OR"
        authenticationStrength = @{
            id = "00000000-0000-0000-0000-000000000004"  # Phishing-resistant MFA
        }
    }
}

New-MgIdentityConditionalAccessPolicy -BodyParameter $prMfaPolicy

# Get MFA registration status for all users
$registrationDetails = Get-MgReportAuthenticationMethodUserRegistrationDetail -All

# Summary statistics
$total = $registrationDetails.Count
$authenticatorRegistered = ($registrationDetails | Where-Object {
    $_.MethodsRegistered -contains "microsoftAuthenticator"
}).Count
$fido2Registered = ($registrationDetails | Where-Object {
    $_.MethodsRegistered -contains "fido2SecurityKey"
}).Count
$notRegistered = ($registrationDetails | Where-Object {
    $_.IsMfaRegistered -eq $false
}).Count

Write-Host "MFA Enrollment Report:"
Write-Host "  Total users: $total"
Write-Host "  Authenticator enrolled: $authenticatorRegistered ($([math]::Round($authenticatorRegistered/$total*100,1))%)"
Write-Host "  FIDO2 enrolled: $fido2Registered ($([math]::Round($fido2Registered/$total*100,1))%)"
Write-Host "  Not MFA registered: $notRegistered ($([math]::Round($notRegistered/$total*100,1))%)"