I'm building a .NET application that runs PowerShell commands and uses certificate-based authentication so it can automate repetitive user-management tasks across multiple Microsoft 365 tenants without interactive sign-ins. Most of the workflow works, including pre-registering a phone authentication method for newly created users. However, I can't find a way to mark MFA as enforced automatically.
Connect-MsolService doesn't support certificate authentication, and the MSOnline module is deprecated, so using it would not be a good long-term solution. Security Defaults are enabled, but they don't appear to force the first-login MFA registration wizard when the user already has an authentication method configured. At the moment, the only reliable workaround I've found is opening the portal and setting the legacy per-user MFA state to Enforced manually.
Conditional Access isn't available because these tenants don't have the required licensing. Is there a Microsoft Graph or Entra PowerShell approach that can set the new user's per-user MFA state to Enabled or Enforced non-interactively using certificate authentication?
4 Answers
The newer Entra PowerShell modules expose the same functionality. One working approach is:
Update-EntraBetaUserAuthenticationRequirement -UserId $UserId -PerUserMfaState "enabled"
If the goal is to prevent sign-in until MFA is completed, check whether your workflow requires the state to be `enforced` rather than merely `enabled`. The exact choice matters, so test the behavior with a newly created test account.
You can update the user’s per-user MFA state through Microsoft Graph rather than relying on the legacy MSOnline module. For example, authenticate to Graph with your certificate-backed application and send a PATCH request to the user’s authentication requirements endpoint:
$body = @{ perUserMfaState = "enforced" }
Invoke-MgGraphRequest -Method PATCH -Uri "/beta/users/$UserId/authentication/requirements" -Body $body
The Graph application will need the appropriate application permissions and admin consent. The endpoint is currently in the beta API, so verify its availability and behavior in your tenants before using it in production.
This was exactly the direction I needed. Certificate authentication can be used for Graph as well, so there’s no reason to fall back to an interactive MSOnline sign-in.
Security Defaults and per-user MFA don’t always behave the way people expect when authentication methods have already been registered. Since Conditional Access isn’t licensed in these tenants, updating the per-user authentication requirement through Graph or the Entra beta module is the practical automation route. Be sure to grant only the required Graph permissions and validate the setting after creating each user.
It’s worth moving away from Connect-MsolService now. MSOnline is deprecated, and newer automation should use Microsoft Graph PowerShell or direct Graph REST calls. Graph modules can authenticate with an application certificate, and `Invoke-MgGraphRequest` is useful when the exact cmdlet isn’t available in the stable module.
I got this working with the Microsoft.Entra.Beta.SignIns module. I initially used `enabled`, but another person pointed out that `enforced` may be the appropriate value when the requirement is to force MFA rather than simply register the user.