Conditional Access on JanBakker.tech

Prevent AiTM with Microsoft Entra Global Secure Access and Conditional Access

Wed, 29 Nov 2023 08:12:43 +0000

Microsoft Entra Global Secure Access brings a new control to Conditional Access. By installing the Global Secure Access Client on (hybrid) Entra joined devices and enabling Global Secure Access signaling for Conditional Access, admins can now work with a new condition: All Compliant Network locations (Preview)

Enforce FIDO2 PIN complexity with Microsoft Entra Conditional Access Authentication Strengths.

Wed, 06 Sep 2023 07:58:50 +0000

As you may or may not know, most FIDO2 security keys can be set up with easy PINs like 1111 or 123456. Just like passwords, users tend to come up with easy-to-remember PINs.

Token2 recently announced their PIN+ series, a line of FIDO2 Security keys. These security keys feature advanced PIN complexity rules that set a new standard for security. PIN+ keys implement specific complexity rules for both numeric and alphanumeric PINs, which can be found here.

Step-up authentication with Defender for Cloud Apps and Authentication Context

Wed, 07 Jun 2023 06:58:07 +0000

In this post, I will show you how you can integrate Azure AD’s Authentication Context with Defender for Cloud Apps to require step-up authentication for specific scenarios. Step-up authentication allows you to re-evaluate Azure AD Conditional Access policies when users take sensitive actions during a session.

Close the gap. Azure AD Identity Protection & Conditional Access.

Tue, 14 Jul 2020 17:34:22 +0000

This blog is about Azure AD Identity Protection and Conditional Access, and how these two features are working together. This is not my first article on this subject. (neither my last) In previous blogs, I covered the sign-in risk and user risk policies as part of the Secure Score Series, and in my blog, about Azure Multifactor Authentication I talked about Azure AD Identity Protection, and how it can be used to roll out MFA in your organization.

Use Power Automate as your Conditional Access Police Department

Sat, 04 Jul 2020 07:10:42 +0000

Last week, I was working on a new blog for the Secure Score Series regarding global admin and break glass accounts. I came to the point where I was thinking of possible scenarios that could go wrong with these accounts. What if someone accidentally added these users to a certain group? What if that group would be triggered in some policy or maintenance tasks? A lot of these actions can be discovered using Microsoft Cloud App Security and Azure Monitor. This way, you will be alerted when someone touches the accounts in any way, or if the account is used to sign-in.

Microsoft Secure Score Series – 06 – Enable policy to block legacy authentication

Wed, 08 Apr 2020 19:15:37 +0000

In this series, I’ll be covering the Microsoft Secure Score improvement actions. Although Microsoft does a great job on telling you what to do, some actions have a much bigger impact and need to be balanced against business needs. Some actions might not even have value for your organization. In the end, Microsoft Secure Score is meant to strengthen your security, not a contest to reach the highest score possible. In this series, I’ll pick out random actions and try to make it as simple as possible, backed with notes from the field.

Require trusted location for MFA and SSPR registration

Sat, 22 Feb 2020 20:02:48 +0000

This article shows how you can block MFA and SSPR registrations from untrusted locations using Azure AD Conditional Acces.

When you want to enable MultiFactor Authentication and Self Service Password Reset for your users, they need to register their security settings first. Since the combined portal arrived, users can do this easily in just one place. Using this combined portal is also a requirement in order to make this possible. Although this portal is still in preview, it has great user experience and wizards run smoothly.