Báo cáo và enforce Per-user MFA cho user không có Entra ID P1

# Chạy thử trước; nhập client secret tại prompt dạng SecureString
.\Enable-PerUserMfa.ps1 `
    -TenantId "<tenant-id>" `
    -ClientId "<client-id>" `
    -ClientSecret (Read-Host -AsSecureString) `
    -WhatIf

# Chạy thật sau khi review danh sách WhatIf và thông báo người dùng
.\Enable-PerUserMfa.ps1 `
    -TenantId "<tenant-id>" `
    -ClientId "<client-id>" `
    -ClientSecret (Read-Host -AsSecureString)

$ErrorActionPreference = "Stop"

$TokenPath = "C:\Temp\GraphToken.txt"
$OutputPath = "C:\Temp\PerUser_MFA_Report.csv"
$token = (Get-Content -Path $TokenPath -Raw -ErrorAction Stop).Trim()
$token = $token -replace '^Bearer\s+', ''

if ([string]::IsNullOrWhiteSpace($token)) {
    throw "Access token file is empty: $TokenPath"
}

$headers = @{
    Authorization = "Bearer $token"
    Accept = "application/json"
}

$uri = "https://graph.microsoft.com/beta/users?`$select=id,userPrincipalName,displayName,perUserMfaState&`$top=999"
$results = [System.Collections.Generic.List[object]]::new()

do {
    $response = Invoke-RestMethod `
        -Uri $uri `
        -Headers $headers `
        -Method Get `
        -ErrorAction Stop

    foreach ($user in $response.value) {
        $results.Add([pscustomobject]@{
            id                = $user.id
            userPrincipalName = $user.userPrincipalName
            displayName       = $user.displayName
            perUserMfaState   = $user.perUserMfaState
        })
    }

    $uri = $response.'@odata.nextLink'
} while ($uri)

$outputDirectory = Split-Path -Parent $OutputPath
if (-not (Test-Path $outputDirectory)) {
    New-Item -ItemType Directory -Path $outputDirectory -Force | Out-Null
}

$results | Export-Csv -Path $OutputPath -NoTypeInformation -Encoding UTF8 -Force
Write-Host "Report exported: $OutputPath"

[CmdletBinding()]
param(
    [switch]$WhatIf,
    [string]$OutputCsv = "C:\Temp\perUserMfaState-disabled-to-enabled-report.csv",
    [int]$ThrottleMs = 150,
    [int]$MaxRetry = 6,
    [Parameter(Mandatory)][string]$TenantId,
    [Parameter(Mandatory)][string]$ClientId,
    [Parameter(Mandatory)][securestring]$ClientSecret
)

$ErrorActionPreference = "Stop"

# Replace these exact-match selectors with values validated against your tenant.
$TargetCompany = "Example Company"
$TargetJobTitle = "Target Job Title"

function Test-GuidString {
    param([string]$Value)

    if ([string]::IsNullOrWhiteSpace($Value)) {
        return $false
    }

    $parsedGuid = [guid]::Empty
    return [guid]::TryParse($Value, [ref]$parsedGuid)
}

function Invoke-GraphWithRetry {
    param(
        [Parameter(Mandatory)]
        [ValidateSet("GET", "PATCH")]
        [string]$Method,
        [Parameter(Mandatory)]
        [string]$Uri,
        [object]$Body = $null,
        [int]$RetryCount = 6
    )

    $attempt = 0
    $delaySeconds = 2

    while ($true) {
        try {
            $request = @{
                Method = $Method
                Uri = $Uri
                OutputType = "PSObject"
                ErrorAction = "Stop"
            }

            if ($null -ne $Body) {
                $request.Body = $Body
            }

            return Invoke-MgGraphRequest @request
        }
        catch {
            $attempt++
            $message = $_.Exception.Message
            $isTransient = $message -match "Too Many Requests|429|timeout|temporarily|503|504|Bad Gateway|Service Unavailable"

            if ($attempt -le $RetryCount -and $isTransient) {
                Write-Warning "Transient Graph error (attempt $attempt/$RetryCount); waiting $delaySeconds seconds."
                Start-Sleep -Seconds $delaySeconds
                $delaySeconds = [Math]::Min($delaySeconds * 2, 60)
                continue
            }

            throw
        }
    }
}

function Export-CsvSafe {
    param(
        [Parameter(Mandatory)]
        [object[]]$Data,
        [Parameter(Mandatory)]
        [string]$Path
    )

    $directory = Split-Path -Parent $Path
    if ($directory -and -not (Test-Path $directory)) {
        New-Item -ItemType Directory -Path $directory -Force | Out-Null
    }

    try {
        $Data | Export-Csv -NoTypeInformation -Encoding UTF8 -Path $Path -Force -ErrorAction Stop
        Write-Host "Report exported: $Path"
    }
    catch {
        $timestamp = Get-Date -Format "yyyyMMdd-HHmmss"
        $fallbackPath = [IO.Path]::ChangeExtension($Path, "$timestamp.csv")
        Write-Warning "Could not write $Path; exporting to $fallbackPath"
        $Data | Export-Csv -NoTypeInformation -Encoding UTF8 -Path $fallbackPath -Force -ErrorAction Stop
        Write-Host "Report exported: $fallbackPath"
    }
}

if (-not (Test-GuidString $TenantId)) {
    throw "TenantId must be a GUID."
}
if (-not (Test-GuidString $ClientId)) {
    throw "ClientId must be the Application (client) ID GUID."
}
if (-not (Get-Command Connect-MgGraph -ErrorAction SilentlyContinue) -or
    -not (Get-Command Get-MgUser -ErrorAction SilentlyContinue) -or
    -not (Get-Command Invoke-MgGraphRequest -ErrorAction SilentlyContinue)) {
    throw "Required Microsoft Graph PowerShell commands are missing. Install and validate Microsoft.Graph before running this script."
}

$clientSecretCredential = [pscredential]::new($ClientId, $ClientSecret)
Connect-MgGraph `
    -TenantId $TenantId `
    -ClientSecretCredential $clientSecretCredential `
    -NoWelcome `
    -ErrorAction Stop

$results = [System.Collections.Generic.List[object]]::new()
$updated = 0
$failed = 0

try {
    $context = Get-MgContext
    if (-not $context -or $context.TenantId -ne $TenantId) {
        throw "Microsoft Graph connection did not establish the expected tenant context."
    }

    $users = Get-MgUser -All -Property Id,UserPrincipalName,DisplayName,AccountEnabled,UserType,CompanyName,JobTitle

    foreach ($user in $users) {
        if ($user.CompanyName -ne $TargetCompany) { continue }
        if ($user.UserType -eq "Guest") { continue }
        if ($user.AccountEnabled -ne $true) { continue }
        if ($user.JobTitle -ne $TargetJobTitle) { continue }

        Start-Sleep -Milliseconds $ThrottleMs
        $uri = "/beta/users/$($user.Id)/authentication/requirements"
        $state = $null
        $action = "none"
        $errorText = $null

        try {
            $requirements = Invoke-GraphWithRetry -Method GET -Uri $uri -RetryCount $MaxRetry
            $state = $requirements.perUserMfaState

            if ($state -eq "disabled") {
                if ($WhatIf) {
                    $action = "would-enable"
                }
                else {
                    $body = @{ perUserMfaState = "enabled" }
                    Invoke-GraphWithRetry -Method PATCH -Uri $uri -Body $body -RetryCount $MaxRetry | Out-Null

                    $verified = Invoke-GraphWithRetry -Method GET -Uri $uri -RetryCount $MaxRetry
                    $state = $verified.perUserMfaState

                    if ($state -ne "enabled") {
                        throw "PATCH completed but verification returned state '$state'."
                    }

                    $action = "enabled"
                    $updated++
                }
            }
        }
        catch {
            $errorText = $_.Exception.Message
            $action = if ($null -eq $state) { "get-failed" } else { "patch-failed" }
            $failed++
        }

        $results.Add([pscustomobject]@{
            UserPrincipalName = $user.UserPrincipalName
            DisplayName = $user.DisplayName
            UserId = $user.Id
            CompanyName = $user.CompanyName
            JobTitle = $user.JobTitle
            AccountEnabled = $user.AccountEnabled
            UserType = $user.UserType
            perUserMfaState = $state
            Action = $action
            Error = $errorText
        })
    }

    Write-Host "Matching users: $($results.Count)"
    Write-Host "Updated disabled -> enabled: $updated"
    Write-Host "Failures: $failed"
    Export-CsvSafe -Data $results.ToArray() -Path $OutputCsv
}
finally {
    Disconnect-MgGraph | Out-Null
}