Setting StrongAuthenticationUserDetails PhoneNumber for AzureAD via Powershell?

user_8473652 0
Viewed 7354

That title really flows.

When setting up computers for use with Azure Active Directory, we would have IT do initial setup and config. This included the first sign in and joining to Azure Active Directory. When signing in it forces you to select a verification method. We would use our desk phone or cell phone for ease.

The time has come for us to update that second factor phone number. I know of a way to manually do it via the Azure AD Web UI, but I am looking for a scripted way to set that number in PowerShell.

Here is how I retrieve the number via PowerShell.

Get-msoluser -UserPrincipalName "email@emailaddress.com" | Select-Object -ExpandProperty StrongAuthenticationUserDetails

That code returns this info:

ExtensionData                     : System.Runtime.Serialization.ExtensionDataObject
AlternativePhoneNumber            :
Email                             :
OldPin                            :
PhoneNumber                       : +1 5554445555
Pin                               :

However, there seems to be no similar option for setting the StrongAuthenticationUserDetails.

All my searches just turned up how to bulk enable 2-factor authentication, which is not what I want to do. I want to leave the StrongAuthentication the same while only updating the phone number.

azure powershell
2 Answers

Disclaimer: the code is provided as-is. It might happen that it'll stop working in case MS changes Azure Portal interface.

I'm using the following Greasemonkey script to update alternate email and phone (phone can be updated via Graph API now so the script will be useful for email only):

// ==UserScript==
// @name     Unnamed Script 548177
// @version  1
// @grant    none
// @namespace https://portal.azure.com
// ==/UserScript==

(function(){
document.addEventListener('keydown', function(e) {
  // press alt+shift+g
  if (e.keyCode == 71 && e.shiftKey && !e.ctrlKey && e.altKey && !e.metaKey) {
    const url = document.URL;
    const regex = /https:\/\/portal.azure.com\/#blade\/Microsoft_AAD_IAM\/UserDetailsMenuBlade\/UserAuthMethods\/userId\/[\w-]+\/adminUnitObjectId[\/]*\?\w+=(\d{9})&\w+=([\w\.-@]+)/;
    const params = url.match(regex);
    const allAuthRows = document.getElementsByClassName('ext-userauthenticationmethods-section-row');
    const authRowsArray = Array.from(allAuthRows);
    let emailRow;
    let phoneRow;
    let i;
    for (i =0; i < authRowsArray.length; i++) {
      if (authRowsArray[i].childNodes[1].childNodes[1].childNodes[0].data === 'Email') {
        emailRow = authRowsArray[i]
      }
      if (authRowsArray[i].childNodes[1].childNodes[1].childNodes.length > 1) {
        if (authRowsArray[i].childNodes[1].childNodes[1].childNodes[1].childNodes[0].data === 'Phone') {
          phoneRow = authRowsArray[i]
        }
      }
    }

    const emailInput = emailRow.childNodes[3].childNodes[1].childNodes[1].childNodes[0].childNodes[0].childNodes[0].childNodes[2];
    const phoneInput = phoneRow.childNodes[3].childNodes[1].childNodes[1].childNodes[0].childNodes[0].childNodes[0].childNodes[2];
    const event = new Event('input', {
        'bubbles': true,
        'cancelable': true
    });
    if (params[1] !== '000000000') {
      phoneInput.value = `+48 ${params[1]}`;
      phoneInput.dispatchEvent(event);
    }
    if (params[2] !== 'null') {
      emailInput.value = params[2];
      emailInput.dispatchEvent(event);
    }
    setTimeout(() => {
      const buttonArr = document.getElementsByClassName('azc-toolbarButton-container fxs-portal-hover');
      const saveButton = Array.from(buttonArr).find(e => e.title === 'Save');
      saveButton.click();
    } , 2000);    

  }
}, false);
})();

It requires you to open Azure portal with querystring like this (I do it with PowerShell):

https://portal.azure.com/#blade/Microsoft_AAD_IAM/UserDetailsMenuBlade/UserAuthMethods/userId/$($u.ObjectId)/adminUnitObjectId/?param1=$newPhone&param2=$newMail

How to use it:

  • open only one tab at a time, otherwise you'll receive Unable to sign-in error
  • from time to time you'll receive that error anyway, so just wait
  • to trigger the script press Alt+Shift+g after the site is loaded (you can change the shortcut in first if)
  • once the data is updated and saved, press Ctrl+w to close the current tab and press Alt+Tab to switch to previous window (should be PowerShell)
  • you're still free to use the code to update the phone. Make sure to change country code (currently +48 for Poland)
user_99025550
Related