Bật MFA cho Nhóm Quản Trị Viên

# Tạo security group cho privileged admins
az ad group create \
  --display-name "GRP-AZ500-PrivilegedAdmins" \
  --mail-nickname "GRP-AZ500-PrivilegedAdmins"

# Lấy Object ID của group vừa tạo
GROUP_ID=$(az ad group show \
  --group "GRP-AZ500-PrivilegedAdmins" \
  --query id -o tsv)
echo "Group ID: $GROUP_ID"

# Lấy Object ID user admin lab và thêm vào group
USER_ID=$(az ad user show \
  --id "[email protected]" \
  --query id -o tsv)
az ad group member add \
  --group "GRP-AZ500-PrivilegedAdmins" \
  --member-id $USER_ID

# Xác nhận membership
az ad group member list \
  --group "GRP-AZ500-PrivilegedAdmins" \
  --query "[].{Name:displayName, UPN:userPrincipalName}" \
  --output table

# Kết nối Graph với quyền cần thiết
Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess","Group.Read.All"

# Lấy Group Object ID
$groupId = (Get-MgGroup -Filter "DisplayName eq 'GRP-AZ500-PrivilegedAdmins'").Id
$breakGlassId = (Get-MgUser -Filter "UserPrincipalName eq '[email protected]'").Id

# Tạo CA policy ở chế độ Report-only
$params = @{
    displayName = "CA-AZ500-RequireMFA-PrivilegedAdmins"
    state = "enabledForReportingButNotEnforced"   # Report-only mode
    conditions = @{
        users = @{
            includeGroups = @($groupId)
            excludeUsers  = @($breakGlassId)       # Exclude break-glass
        }
        applications = @{
            includeApplications = @("797f4846-ba00-4fd7-ba43-dac1f8f63013") # Azure Management
        }
    }
    grantControls = @{
        operator = "OR"
        builtInControls = @("mfa")
    }
}
New-MgIdentityConditionalAccessPolicy -BodyParameter $params
Write-Host "CA policy created in Report-only mode"

# Xem sign-in logs gần nhất của admin user
Connect-MgGraph -Scopes "AuditLog.Read.All"

$userId = (Get-MgUser -Filter "UserPrincipalName eq '[email protected]'").Id

Get-MgAuditLogSignIn `
  -Filter "userId eq '$userId'" `
  -Top 5 |
  Select-Object CreatedDateTime, UserPrincipalName,
    @{N="AppDisplayName";E={$_.AppDisplayName}},
    @{N="CAResult";E={$_.ConditionalAccessStatus}} |
  Format-Table -AutoSize

# Bật policy từ Report-only sang On
$policyId = (Get-MgIdentityConditionalAccessPolicy `
  -Filter "displayName eq 'CA-AZ500-RequireMFA-PrivilegedAdmins'").Id

Update-MgIdentityConditionalAccessPolicy `
  -ConditionalAccessPolicyId $policyId `
  -State "enabled"    # "enabled" = On | "disabled" = Off | "enabledForReportingButNotEnforced" = Report-only

Write-Host "Policy state updated to: enabled (On)"

# Xác nhận trạng thái
Get-MgIdentityConditionalAccessPolicy -ConditionalAccessPolicyId $policyId |
  Select-Object DisplayName, State