如何 pipe Where-Object output 进入 Azure AD 组

Question

After a group member has enrolled for MFA, I need to remove the member from one Azure AD group and add them to another group.

When I run the script I receive no errors, but it does not remove/add members as expected. I can verify it makes it through Step 2 but does nothing after that. I believe I need a Select-Object in the beginning of Step 3.

Script will remove members from Group A and move them to Group B if the member has enrolled in MFA.

1. Get-AzureADGroupMember -ObjectId "7d23abf4-4e30-4092-b4e6-a5297addad75" |

2. Where-Object {$_.StrongAuthenticationMethods -ne $null} |

3. Add-AzureADGroupMember -ObjectId "24db4ad9-8fe0-45f6-a71a-79b76395105a" |

4. Remove-AzureADGroupMember -ObjectId "7d23abf4-4e30-4092-b4e6-a5297addad75"

    Step 1. Get member of Group A Step 2. Where member has enrolled in MFA Step 3. Add member to Group B Step 4. Remove member from Group A

Script should audit one Azure Ad group (A) to see which members have enrolled in MFA, remove those who have enrolled from the group, and move them to another group (B).

Answer 1

There are two issues about your script.

1.The | means powershell pipline, it is not such usage, more details see this link .

2.The User entity in AzureAD powershell does not have the StrongAuthenticationMethods property, it exists in the MSOnline powershell , so you need to use that instead.

Here is a sample for you, make sure you have installed the MSOnline powershell module with Install-Module MSOnline .

Note : You need to make sure the users are not already in the Group B, otherwise you will get an error The group member you are trying to add is already a member of this group .

Connect-MsolService

$groupA = "<objectid of group A>"
$groupB = "<objectid of group B>"

#get the users(whose GroupMemberType is 0) in the group A
$userids = (Get-MsolGroupMember -GroupObjectId $groupA | Where-Object {$_.GroupMemberType -eq '0'}).ObjectId
#add the MFA-enrolled user to A and remove from B
foreach($item in $userids){
    $user = Get-MsolUser -ObjectId $item
    if($user.StrongAuthenticationMethods.Count -ne "0"){
        Add-MsolGroupMember -GroupObjectId $groupB -GroupMemberType User -GroupMemberObjectId $item
        Remove-MsolGroupMember -GroupObjectId $groupA -GroupMemberType User -GroupMemberObjectId $item

    }else{
        Write-Host The user $user.DisplayName is not MFA-enrolled.
    }
}