问题描述

如何在中国区获取用户 StrongAuthenticationUserDetails 和 StrongAuthenticationMethods 信息？

StrongAuthenticationUserDetails ：包含有关用户 MFA 设置的信息，例如他们首选的身份验证方法、电话号码和电子邮件地址。系统使用此信息在用户尝试访问受保护资源时验证用户的身份。
StrongAuthenticationMethods ：是一个用户对象的属性，它包含了用户已注册的多重身份验证方法的信息。

PS: 中国区Azure上无法通过 Graph API (: https://graph.chinacloudapi.cn/myorganization/users('XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX')?api-version=1.6-internal) 获取MFA的信息

问题解答

经过调查，可以通过PowerShell脚本来实现获取用户在MFA中的信息，使用MS Online PowerShell module，通过 Connect-MsolService 登录Azure AD(Azure Entra ID)后，然后执行 get-msoluser 获取User

第一步：安装 msonline module

PS C:\> Connect-MsolService -AzureEnvironment AzureChinaCloud 
Connect-MsolService : The term 'Connect-MsolService' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if 
a path was included, verify that the path is correct and try again.
At line:1 char:1
+ Connect-MsolService -AzureEnvironment AzureChinaCloud
+ ~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Connect-MsolService:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException

遇见以上错误，则需要安装 MSOnline模块(需要在Administrator模式下安装)。

Install-Module -Name MSOnline

第二步：连接到中国区Azure （并交互式登录用户名和密码）

Connect-MsolService -AzureEnvironment AzureChinaCloud

OR 通过无交互式方式登录（无弹窗）

$azureUsername=‘{user@xxxx.onmicrosoft.com}’
$azurePassword = ConvertTo-SecureString "<Password>" -AsPlainText -Force
$psCred = New-Object System.Management.Automation.PSCredential($azureUsername , $azurePassword)
Connect-MsolService -Credential $psCred

第三步：获取用户 StrongAuthenticationUserDetails 和 StrongAuthenticationMethods 属性

 $user01 =get-msoluser -User <UPN: User principal name, e.g:xxxx@xxxx.xxxx.onmschina.cn>

 $am = $user01.StrongAuthenticationMethods
 $am

 $ud = $user01.StrongAuthenticationUserDetails
 $ud

附录：完整的PowerShell Script

#Install MS Online Module

Install-Module -Name MSOnline

# Login

Connect-MsolService -AzureEnvironment AzureChinaCloud

# Login with username & password

$azureUsername=‘{user@xxxx.onmicrosoft.com}’

$azurePassword = ConvertTo-SecureString "<Password>" -AsPlainText -Force

$psCred = New-Object System.Management.Automation.PSCredential($azureUsername , $azurePassword)

Connect-MsolService -Credential $psCred

# get user StrongAuthenticationMethods

$user01 =get-msoluser -User <UPN: User principal name, e.g:xxxx@xxxx.xxxx.onmschina.cn>

$am = $user01.StrongAuthenticationMethods

$am

# get user StrongAuthenticationUserDetails

$ud = $user01.StrongAuthenticationUserDetails

$ud