runbook-dynamicgroup-mfa.ps1

<#PSScriptInfo
.VERSION 0.4
.GUID 21da31c8-4f69-419d-8a3f-f16168b8f3ae
.AUTHOR Dominik Gilgen
.COMPANYNAME Dominik Gilgen (Personal)
.COPYRIGHT 2023 Dominik Gilgen. All rights reserved.
.LICENSEURI https://github.com/M365-Consultant/EntraID-MFA-DynamicGroup/blob/main/LICENSE
.PROJECTURI https://github.com/M365-Consultant/EntraID-MFA-DynamicGroup
.TAGS AzureAD EntraID MFA ConditionalAccess DynamicGroup Runbook
.RELEASENOTES
This script now supports email reporting, which requires the permission 'Mail.Send' and the Graph-Module 'Microsoft.Graph.Users.Actions'.
Instead of variables it is now using parameters for the input.
#>

<# 

.DESCRIPTION 
 Azure Runbook - Dynamic Group - MFA State
 
 This script is designed for an Azure Runbook to assign users to two Azure AD groups based on their MFA capability (capable / non-capable).
 Before running the runbook, you need to set up an automation account with a managed identity.

 The managed identity requires the following Graph Permissions:
    - User.Read.All
    - Group.ReadWrite.All
    - UserAuthenticationMethod.Read.All
    - Mail.Send


 The script requires the following modules:
    - Microsoft.Graph.Authentication
    - Microsoft.Graph.Groups
    - Microsoft.Graph.Identity.SignIns
    - Microsoft.Graph.Users
    - Microsoft.Graph.Users.Actions

 There are a few parameters which must be set for a job run:
    - $groupid_capable -> The Object-ID of a EntraID (AzureAD) group where MFA capable uers's should be assigned
    - $groupid_noncapable -> The Object-ID of a EntraID (AzureAD) group where MFA NON-capable uers's should be assigned
    - $mailMode -> This controls the mail behavior. Enter the mode you want without using '
        'always' - sends a mail on every run
        'changes' - sends a mail only if there were any changes
        'disabled' - never send a mail
    - $mailSender -> The mail-alias from which the mail will be send (can be a user-account or a shared-mailbox)
    - $mailRecipients -> The recipient(s) of the mail (internal or external). If you want more than one recipient, you can separate them with the character ; in between.

#> 

Param
(
  [Parameter (Mandatory= $true)]
  [String] $groupid_capable = "Enter Group-ID for MFA capable",
  [Parameter (Mandatory= $true)]
  [String] $groupid_noncapable = "Enter Group-ID for MFA non-capable",
  [Parameter (Mandatory= $false)]
  [String] $mailMode,
  [Parameter (Mandatory= $false)]
  [String] $mailSender,
  [Parameter (Mandatory= $false)]
  [String] $mailRecipients
)

#Connect to Microsoft Graph using a Managed Identity
Connect-MgGraph -Identity

#Preparing necessary variables
$users = get-mguser -All
$members_capable = Get-MgGroupMember -GroupId $groupid_capable -All
$members_noncapable = Get-MgGroupMember -GroupId $groupid_noncapable -All
$groupname_capable = Get-MgGroup -GroupId $groupid_capable
$groupname_noncapable = Get-MgGroup -GroupId $groupid_noncapable

#Preparing mail content
$mailContentHeader = "<p>The Azure runbook for dynamic group based on the user's MFA state has been executed.</p><p>Those are the changes from this run:</p>"
$mailContentChanges = "<ul>"

#Running the MFA state check for every user and assign them to correct groups
foreach ($user in $users) {
    $mfa = Get-MgUserAuthenticationMethod -UserId $user.UserPrincipalName -All | Where-Object {$_.AdditionalProperties."@odata.type" -ne "#microsoft.graph.passwordAuthenticationMethod"}
    if ($mfa.Count -gt 0) {
            if ($members_capable.Id -notcontains $user.Id){
                New-MgGroupMember -GroupId $groupid_capable -DirectoryObjectId $user.Id
                $output = $user.UserPrincipalName + " added to '" + $groupname_capable.DisplayName + "'. User-ID: " + $user.Id
                Write-Output $output
                $outputMail = "<li>" + $user.UserPrincipalName + " <font color='green'>added</font> to '" + $groupname_capable.DisplayName + "'.  <font color='grey'>(User-ID: " + $user.Id + ")</font></li>"
                $mailContentChanges += $outputMail
            }
            if ($members_noncapable.Id -contains $user.Id){
                Remove-MgGroupMemberByRef -GroupId $groupid_noncapable -DirectoryObjectId $user.Id
                $output = $user.UserPrincipalName + " removed from '" + $groupname_noncapable.DisplayName + "'. User-ID: " + $user.Id
                $outputMail = "<li>" + $user.UserPrincipalName + " <font color='orange'>removed</font> from '" + $groupname_noncapable.DisplayName + "'. <font color='grey'>(User-ID: " + $user.Id + ")</font></li>"
                Write-Output $output
                $mailContentChanges += $outputMail
            }
    }
    else{
            if($members_noncapable.Id -notcontains $user.Id){ 
                New-MgGroupMember -GroupId $groupid_noncapable -DirectoryObjectId $user.Id
                $output = $user.UserPrincipalName + " added to '" + $groupname_noncapable.DisplayName + "'. User-ID: " + $user.Id
                $outputMail = "<li>" + $user.UserPrincipalName + " <font color='green'>added</font> to '" + $groupname_noncapable.DisplayName + "'. <font color='grey'>(User-ID: " + $user.Id + ")</font></li>"
                Write-Output $output
                $mailContentChanges += $outputMail
            }
            if($members_capable.Id -contains $user.Id){
                Remove-MgGroupMemberByRef -GroupId $groupid_capable -DirectoryObjectId $user.Id
                $output = $user.UserPrincipalName + " removed from '" + $groupname_capable.DisplayName + "' because this account has become non-capable! User-ID: " + $user.Id
                $outputMail = "<li><font color='red'><b>WARNING: </b></font>" + $user.UserPrincipalName + " <font color='orange'>removed</font> from '" + $groupname_capable.DisplayName + "' because this account has become non-capable! <font color='grey'>(User-ID: " + $user.Id + ")</font></li>"
                Write-Warning $output
                $mailContentChanges += $outputMail
            }
    }
}

if ($mailContentChanges -eq "<ul>"){
    $mailContentChanges = "<b>No changes made.</b>"
    Write-Output "No changes made."
}
else { $mailContentChanges += "</ul>" }

# Sendmail
function runbookSendMail {
    $mailRecipientsArray = $mailRecipients.Split(";")
    $mailSubject = "Azure Runbook Report: Dynamic Group MFA State"
    $mailContentFooter = "<br><br><p style='color: grey'>You can find additional details in the job history of this runbook.<br>Job finished at (UTC) " + (Get-Date).ToUniversalTime() + "<br>Job ID:"+ $PSPrivateMetadata.JobId.Guid + "</p>"
    $mailContent = $mailContentHeader + $mailContentChanges + $mailContentFooter

    $params = @{
            Message = @{
                Subject = $mailSubject
                Body = @{
                    ContentType = "html"
                    Content = $mailContent
                }
                ToRecipients = @(
                    foreach ($recipient in $mailRecipientsArray) {
                        @{
                            EmailAddress = @{
                                Address = $recipient
                            }
                        }
                    }
                )
            }
            SaveToSentItems = "false"
        }
        
    Send-MgUserMail -UserId $mailSender -BodyParameter $params
    Write-Output "Mail has been sent."
}

if ($mailMode -eq "always" -and $mailSender -and $mailRecipients) { runbookSendMail }
elseif ($mailMode -eq "changes" -and $mailSender -and $mailRecipients -and ($mailContentChanges -ne "<b>No changes made.</b>")) { runbookSendMail }
elseif ($mailMode -eq "changes" -and $mailSender -and $mailRecipients) { Write-Output "No mail sent, because there are no changes and mailmode is set to 'changes'." }
elseif ($mailMode -eq "disabled"){ Write-Output "Mail function is disabled." }
else { Write-Warning "Mail settings are missing or incorrect" }


#Disconnect from Microsoft Graph within Azure Automation
Disconnect-MgGraph