How do I get powershell to return all users with MFA turned off?

Question

I'm rather new to powershell scripting and seem to be having issues getting powershell to return a list of all users within a particular group that have MFA turned off. I plan on having the output put into a.csv file later. This is what I've cobbled together sofar:

Connect-MsolService


$GroupA = <Group ID>
$Path = <File Path>

Get-MsolGroupMember -GroupObjectId $GroupA | Get-MsolUser | ? 
{$_.StrongAuthenticationMethods -ne $null} | Sort DisplayName

However some of the users in the list it returns have MFA turned on. I'd appreciate any help. Thank you.

Answer 1

That attribute will never equal $null from what I can tell, even when it's empty. Eg. if you run:

Get-MsolUser | ForEach-Object { $_.StrongAuthenticationMethods.GetType() }

you'll see output like

IsPublic IsSerial Name                                     BaseType
-------- -------- ----                                     --------
True     True     List`1                                   System.Object
True     True     List`1                                   System.Object
True     True     List`1                                   System.Object

no matter whether the attribute has values in it or not, there's always a list object there.

I'd go with @Theo's suggestion, so something like this:

Connect-MsolService
$GroupA = <Group ID>
$Path = <File Path>
Get-MsolGroupMember -GroupObjectId $GroupA | Get-MsolUser | 
    Where-Object { $_.StrongAuthenticationMethods.Count -eq 0 } |
        Sort-Object DisplayName