Modern Workplace Mastery: Day 7 – MFA Baselines

Goal

Create the CalderCloud break-glass set only if missing, and stop if you already have more than two.

What this script does

• Checks for existing users with the xx-breakglass- prefix
• If 0, creates 01 and 02
• If 1, creates the missing one
• If 2, does nothing (success)
• If >2, stops and tells you to rationalise to two
• Assigns Global Administrator (where Graph role assignment is permitted)
• Creates the exclusion group xx-Identity-EmergencyAccess-Excluded if missing
• Adds the break-glass users to that group

Prerequisites / permissions

You’ll need an account with permissions equivalent to:

• create users
• assign directory roles
• create/manage groups

Graph permissions (scopes) used:

• User.ReadWrite.All
• Group.ReadWrite.All
• RoleManagement.ReadWrite.Directory

Note: Some tenants require Privileged Identity Management (PIM) activation for role assignment operations. If role assignment fails, the script will warn and you can complete that step in the portal.

Warning: PowerShell Safety Note (testing + responsibility)
This script is shared for educational purposes to support the Modern Workplace Mastery journey. You must test and validate them in a non-production environment (or tightly scoped pilot) before using them in production.
By using these scripts, you accept responsibility for reviewing, adapting, and confirming they fit your environment. SharePointMark / Modern Workplace Mastery cannot be responsible for outages, misconfiguration, data access issues, or security impact caused by running scripts without proper testing and change control.

• Run with least privilege (use the minimum role set needed).

• Use a test tenant / pilot group first.

• Read the script end-to-end before execution (no mystery meat).

• Log outputs (export results to CSV/JSON) so you can prove what changed.

• Have a rollback plan (or at least a “revert settings” script for key toggles).

This script prints generated passwords to the PowerShell console so you can copy / vault them. Run this script in a secure environment and immediately store secrets. You may prefer to generate passwords inside your own password vault and paste them in, or integrate with a secure secret store. It will refuse to create more than two accounts.

Example Script

<#
Break-glass accounts check and creation (safe / pre-flight)
– Creates xx-breakglass-01 and xx-breakglass-02 only if missing
– Refuses to create if > 2 accounts already exist
– Assigns Global Administrator
– Creates exclusion group and adds accounts

Run in PowerShell 7+ recommended.
#>

$ErrorActionPreference = “Stop”

# ====== CONFIG ======
$UpnPrefix     = “xx-breakglass-“
$Domain        = “yourdomain.com”   # <– CHANGE THIS
$DisplayPrefix = “Secure Break-glass “
$ExclGroupName = “XX-Identity-EmergencyAccess-Excluded”
$ExclGroupDesc = “Exclude from Conditional Access – Emergency access accounts only”

# Choose how you want to set passwords:
# Option A: Prompt securely (recommended for interactive runs)

# ====== CONNECT ======
Connect-MgGraph -Scopes @(
  “User.ReadWrite.All”,
  “Group.ReadWrite.All”,
  “RoleManagement.ReadWrite.Directory”
) | Out-Null

Write-Host “Connected to Microsoft Graph.” -ForegroundColor Green

# ====== FUNCTIONS ======

function New-SecurePassword {
    param([int]$Length = 24)
    # Simple generator: random base64-ish, then trim. Replace with vault-generated secrets if preferred.
    $bytes = New-Object byte[] ($Length)
    [System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($bytes)
    ([Convert]::ToBase64String($bytes)).Substring(0,$Length)
}

function Get-BreakGlassUsers {
    # Fetch by prefix. startsWith requires eventual consistency headers in some calls; Get-MgUser handles it.
    Get-MgUser -All -Filter “startsWith(userPrincipalName,’$UpnPrefix’)” `
      -Property “id,displayName,userPrincipalName,accountEnabled”
}

function Ensure-ExclusionGroup {
    $grp = Get-MgGroup -All -Filter “displayName eq ‘$ExclGroupName'” -Property “id,displayName” | Select-Object -First 1
    if (-not $grp) {
        Write-Host “Creating exclusion group: $ExclGroupName” -ForegroundColor Yellow
        $grp = New-MgGroup -DisplayName $ExclGroupName `
            -Description $ExclGroupDesc `
            -MailEnabled:$false `
            -SecurityEnabled:$true `
            -MailNickname (“xx-” + ([Guid]::NewGuid().ToString(“N”)).Substring(0,12)) `
            -GroupTypes @()
    } else {
        Write-Host “Exclusion group exists: $ExclGroupName” -ForegroundColor Green
    }
    return $grp
}

function Ensure-GroupMember {
    param(
        [Parameter(Mandatory)] [string]$GroupId,
        [Parameter(Mandatory)] [string]$UserId
    )
    # Check membership (best-effort). If check is slow in huge tenants, we can skip and just attempt add with try/catch.
    $isMember = $false
    try {
        $members = Get-MgGroupMember -GroupId $GroupId -All -Property “id”
        $isMember = $members.Id -contains $UserId
    } catch {
        # If membership read fails, proceed to add attempt.
        $isMember = $false
    }

    if (-not $isMember) {
        Write-Host “Adding user to exclusion group…” -ForegroundColor Yellow
        New-MgGroupMember -GroupId $GroupId -DirectoryObjectId $UserId | Out-Null
    } else {
        Write-Host “User already in exclusion group.” -ForegroundColor Green
    }
}

function Ensure-GlobalAdminRoleAssignment {
    param(
        [Parameter(Mandatory)] [string]$UserId
    )
    # Get role definition ID for Global Administrator
    $ga = Get-MgRoleManagementDirectoryRoleDefinition -Filter “displayName eq ‘Global Administrator'” -Property “id,displayName” | Select-Object -First 1
    if (-not $ga) {
        Write-Warning “Could not locate Global Administrator role definition. Skipping role assignment.”
        return
    }

    # Check if assignment exists already
    $existing = Get-MgRoleManagementDirectoryRoleAssignment -All -Filter “principalId eq ‘$UserId’ and roleDefinitionId eq ‘$($ga.Id)'” `
        -Property “id,principalId,roleDefinitionId” | Select-Object -First 1

    if ($existing) {
        Write-Host “Global Administrator already assigned.” -ForegroundColor Green
        return
    }

    Write-Host “Assigning Global Administrator role…” -ForegroundColor Yellow
    try {
        New-MgRoleManagementDirectoryRoleAssignment -PrincipalId $UserId `
            -RoleDefinitionId $ga.Id `
            -DirectoryScopeId “/” | Out-Null
        Write-Host “Role assignment completed.” -ForegroundColor Green
    } catch {
        Write-Warning “Role assignment failed. This may require PIM activation or higher privileges. Assign in the portal if needed.”
    }
}

function New-BreakGlassUser {
    param(
        [Parameter(Mandatory)] [string]$Upn,
        [Parameter(Mandatory)] [string]$DisplayName,
        [Parameter(Mandatory)] [string]$PasswordPlain
    )

    $pwdProfile = @{
        Password = $PasswordPlain
        ForceChangePasswordNextSignIn = $false
    }

    Write-Host “Creating user: $Upn” -ForegroundColor Yellow
    New-MgUser -AccountEnabled:$true `
        -DisplayName $DisplayName `
        -MailNickname ($Upn.Split(“@”)[0]) `
        -UserPrincipalName $Upn `
        -PasswordProfile $pwdProfile | Out-Null
}

# ====== PRE-FLIGHT ======
$existing = Get-BreakGlassUsers

Write-Host “Detected $($existing.Count) existing break-glass account(s) with prefix ‘$UpnPrefix’.” -ForegroundColor Cyan
$existing | Sort-Object userPrincipalName | Select-Object displayName,userPrincipalName,accountEnabled | Format-Table -AutoSize

if ($existing.Count -gt 2) {
    throw “More than two break-glass accounts already exist. CalderCloud standard is exactly two. Rationalise first; script will not proceed.”
}

# Determine which accounts are missing
$targets = @(“01″,”02”) | ForEach-Object { “$UpnPrefix$_@$Domain” }
$missing = $targets | Where-Object { $existing.userPrincipalName -notcontains $_ }

if ($missing.Count -eq 0) {
    Write-Host “Exactly two accounts already exist. No creation required.” -ForegroundColor Green
} else {
  foreach ($upn in $missing) {
      $suffix = ($upn.Split(“@”)[0]).Split(“-“)[-1] # 01/02
      $displayName = $DisplayPrefix + $suffix
      $pwd = New-SecurePassword 24
      New-BreakGlassUser -Upn $upn -DisplayName $displayName -PasswordPlain $pwd

      Write-Host “IMPORTANT: Store this password securely NOW for $upn” -ForegroundColor Red
      Write-Host $pwd -ForegroundColor Red
      Write-Host “Do not leave this in console history. Move it to your vault immediately.” -ForegroundColor Red
    }
}

# Refresh list
$breakGlass = Get-BreakGlassUsers
if ($breakGlass.Count -ne 2) {
    throw “Post-creation validation failed: expected exactly two break-glass accounts, found $($breakGlass.Count).”
}

# ====== ROLE ASSIGNMENT ======
foreach ($u in $breakGlass) {
    Ensure-GlobalAdminRoleAssignment -UserId $u.Id
}

# ====== EXCLUSION GROUP ======
$grp = Ensure-ExclusionGroup
foreach ($u in $breakGlass) {
    Ensure-GroupMember -GroupId $grp.Id -UserId $u.Id
}

Write-Host “Completed: break-glass accounts validated/created, role assignment attempted, exclusion group ensured, membership ensured.” -ForegroundColor Green