Mfa on JanBakker.tech

Enforce FIDO2 PIN complexity with Microsoft Entra Conditional Access Authentication Strengths.

Wed, 06 Sep 2023 07:58:50 +0000

As you may or may not know, most FIDO2 security keys can be set up with easy PINs like 1111 or 123456. Just like passwords, users tend to come up with easy-to-remember PINs.

Token2 recently announced their PIN+ series, a line of FIDO2 Security keys. These security keys feature advanced PIN complexity rules that set a new standard for security. PIN+ keys implement specific complexity rules for both numeric and alphanumeric PINs, which can be found here.

Manage user-preferred multi-factor authentication method in Microsoft Entra ID

Tue, 11 Jul 2023 18:58:26 +0000

This post is all about setting the preferred multi-factor authentication method using Graph API. We already know the system-preferred multi-factor authentication method, where Microsoft Entra ID will use the strongest method of all the registered methods, but this time we take a look a the default method set by the user.

Send an email on a new Azure MFA method registration

Fri, 02 Jun 2023 09:50:08 +0000

I’ve done quite some Azure MFA projects over time (and counting), and as we mainly focus on the technical side, there are also practical sides to consider. Every project has its own approach and challenges, and more importantly: the user is impacted more or less, and that asks for some guidance.

Report Suspicious Activity & Fraud Alert for Azure MFA

Thu, 04 May 2023 12:41:33 +0000

A new feature popped up in Azure AD. Well, not entirely new, I must say. Reading from the docs, Report Suspicious Activity is an enhancement of the Fraud Alert feature that has existed for quite some time.

Until now, administrators could enable Fraud Alert for Azure MFA so that users could report when suspicious MFA prompts are received. Users who reported fraud could be automatically blocked so they could no longer sign in. As this is a good feature, it kills productivity, as the intervention of an admin can only remediate the user. This admin would then need to unblock the user and ensure the user’s identity was secured.

Authenticator Lite - Approve Azure MFA prompts with the Outlook app

Tue, 14 Mar 2023 12:28:09 +0000

Microsoft released a new feature where the Outlook mobile app now has some of the Microsoft Authenticator App features onboard. Users can now enroll for Azure MFA using just their Outlook mobile app. No additional installation of the Microsoft Authenticator app is needed. This preview brings both push notifications and TOTP to the Outlook mobile app. Users are prompted for enrollment or can manually register their app to work with a Microsoft 365 account once this feature is enabled.

System-preferred multifactor authentication in Azure AD. Don't settle for less.

Fri, 03 Mar 2023 14:39:38 +0000

A new feature has popped up in Azure AD: System-preferred multifactor authentication (MFA). This will allow administrators to enforce the most secure method for Azure MFA. For example, if a user has multiple methods registered, the most secure method will be prompted first. How do I know what method is the strongest, you may ask? Here is the current order from most to least secure methods, currently supported in Azure Active Directory:

Azure MFA authentication method analysis. Share the results with Power Automate!

Tue, 08 Sep 2020 20:34:51 +0000

You might have seen the sample script, created by the Microsoft community, to run some analysis on your Azure MFA authentication methods. This script can be used to make recommendations on how to improve each user’s MFA configuration.

You can run the script against your tenant, and the results can be exported to a CSV file. Wouldn’t it be cool to share those results with your users straight away? With the use of Power Automate (Flow), we can easily send recommendations to each of our end users. Today I’ll show you how this can be done in a few clicks.

Prepopulate phone methods using a Custom Connector in Power Automate

Thu, 30 Jul 2020 07:30:00 +0000

This blog post shows the custom connector that is built on top of the Microsoft Graph API. With this connector, you can do bulk actions on Azure AD and provision phone numbers for your users. They can be used for MFA and SSPR. To understand how the connector works, please also read the first part of the blog where I explain the API in detail. In the second part, I have added a step-step-guide on how to create the custom connector and use it in an automation flow.

Prepopulate phone methods for MFA and SSPR using Graph API

Thu, 30 Jul 2020 07:29:00 +0000

A first look at Administrative Units and My Staff in Azure Active Directory

Sat, 20 Jun 2020 07:47:15 +0000

Recently, Microsoft introduced Administrative Units in Azure Active Directory. At the time of writing, this feature is in preview. Today we take a first look at how this is going to help organizations managing users and groups in Azure Active Directory. But to understand why this feature is such a big deal, we need to know what the difference is between the “classic” Active Directory and the “modern” Azure Active Directory structure.

Sure, keep me signed in! And don't prompt for MFA!

Fri, 22 May 2020 13:40:49 +0000

Today a short blog about MFA prompts, session lifetime, and cookies. This will give you an idea of how you can tune the end-user experience and where to configure these settings.

Session lifetime in Azure AD is often mistaken. When you start working with Azure AD, Conditional Access, and Multi-factor authentication, there are a couple of things you should know. The Azure AD defaults are pretty loose. When you leave every setting to default, the user experience is pretty good. Once you logged in to Office 365, your session can be re-used for 90 days. During that time, you are not prompted for your password, assuming that is it not changed over time.

What admins should know about the combined registration portal for Azure MFA and Self Service Password Reset

Sat, 02 May 2020 12:06:20 +0000

This post is outdated. There is a new way to manage authentication methods#

Learn more

The (long) title pretty much reveals the purpose of this blog post. This one was on my to-do list for a while now, and now the combined registration portal is General Available, the time was there. In my previous MFA-related blogs, I always encouraged my readers to turn on the combined registration portal, even when it was in public preview. But if you start using this portal, there are quite some settings that can change the user experience of the registration. And that’s mainly what this blog post is about. Let’s see how each setting reflects to the end user.

Microsoft Secure Score Series – 07 – Turn on sign-in risk policy

Mon, 13 Apr 2020 14:17:04 +0000

In this series, I’ll be covering the Microsoft Secure Score improvement actions. Although Microsoft does a great job on telling you what to do, some actions have a much bigger impact and need to be balanced against business needs. Some actions might not even have value for your organization. In the end, Microsoft Secure Score is meant to strengthen your security, not a contest to reach the highest score possible. In this series, I’ll pick out random actions and try to make it as simple as possible, backed with notes from the field.

Use Power Automate for your custom "dynamic" groups

Wed, 01 Apr 2020 19:52:46 +0000

Azure AD Dynamic Groups#

Dynamic groups in Azure AD are awesome. I use them a lot. Dynamic groups can create groups based on attributes. For example, you can create a group that includes all the users from the Sales Team. The query for the group would look like this:

Microsoft Secure Score Series – 04 – Ensure all users can complete multi-factor authentication for secure access

Fri, 27 Mar 2020 21:19:07 +0000

How to publish on-premises applications and protect them with MFA

Fri, 13 Mar 2020 18:56:31 +0000

Using Azure Application Proxy you can publish your on-premises web applications in a secure way. Combining this with Conditional Access, you can configure MFA for example. Now Coronavirus is hitting us hard, you might have to take a look at this feature.

Microsoft Secure Score Series – 02 – Require MFA for administrative roles

Wed, 11 Mar 2020 20:25:28 +0000

Require trusted location for MFA and SSPR registration

Sat, 22 Feb 2020 20:02:48 +0000

This article shows how you can block MFA and SSPR registrations from untrusted locations using Azure AD Conditional Acces.

When you want to enable MultiFactor Authentication and Self Service Password Reset for your users, they need to register their security settings first. Since the combined portal arrived, users can do this easily in just one place. Using this combined portal is also a requirement in order to make this possible. Although this portal is still in preview, it has great user experience and wizards run smoothly.