#Modern Workplace

  Working on my own tenant resulted in re-visiting the password protection policies that I had configured some time ago. As a result, I wanted to explore all possible settings and thus came about the idea of putting a blog post together. Recent studies suggest that weak passwords are often the root cause of data breaches, hacks, and other cybersecurity incidents. They’re the weak link in the chain, easily guessable by hackers looking to brute force their way into a business or individual’s online accounts. This is where the need for strong Password protection policies comes into play. Microsoft Entra ID Password Protection   Microsoft Entra ID Password Protection can help you defend against password spray attacks. Most password spray attacks don't attempt to attack any given individual account more than a few times. This behavior would increase the likelihood of detection, either via account lockout or other means. The majority of password spray attacks submit only a small num...

If you are using Device Enrollment Managers account (aka DEM) to enroll devices in Microsoft Intune in bulk, then this blog post may just help you. In case you are new to DEM account, then it is basically a non-administrator user account that can be used to enroll devices in Intune. Device enrollment managers are useful when you need to enroll and prepare many devices for distribution. People signed in to a DEM account can enroll and manage up to 1,000 devices, while a standard non-admin account can only enroll 15. It is important to note that a DEM account requires an Intune user or device license, and an associated Azure AD user. Global Administrators and Intune Service Administrators can add and manage device enrollment managers in the Microsoft Intune admin center. However, there are some limitations and according to Microsoft, "Applying an Azure AD maximum device limit of less than 1,000 to a DEM account will prevent you from reaching the 1,000 device limit that the DEM acco...

  While working on a device management project, I came across the requirement of MFA during device join using Access work or school method. Nothing out of the ordinary, but it did open a discussion with the customer and one of the talking points was the enablement of MFA itself which prompted me to write this blog post. Multifactor authentication is an integral and important part of Microsoft's Zero Trust security model. The massive increase in mobile devices connecting to corporate resources resulted in evolving of the multifactor authentication system from physical smart cards to a phone-based challenge (phone-factor) and later moving into a more modern experience using the Microsoft Azure Authenticator application. This expanded to enrolling of  devices into a modern management system which checks the health of the device to control access to company resources. As of writing this blog, there are mainly 2 ways to enable MFA for device registration or join to AAD. 1. A tenan...

If you manage and protect corporate data on end user devices, then you may have come across situations where enterprise applications may need to be given admin's consent before the policies can be applied. Through this blog, I will be demonstrating a simple admin approval workflow that you can implement in your organizational tenant to allow the use of your Azure AD identity and manage the access permissions against your enterprise apps to protect corporate data when being used by various services. For all intend and purposes, I will be using Intune App Protection Policies as an example when a user tries to access corporate data through Adobe Acrobat Reader on their BYOD. Let's start by configuring User consent settings As of writing this blog, currently there are 3 options available for controlling User consent as shown below. Microsoft recommends to allow user consent for verified publishers, but in my opinion, to ensure complete control of such requests, it is best to only a...

On May 26, 2023, Microsoft moved Microsoft Authenticator Lite App to General availability . Authenticator Lite was introduced to help organizations adopt alternative tool of authentication for users who had still not downloaded the full Microsoft Authenticator application for MFA, in an endeavor to enhance the security by moving from text message (SMS) and voice-based authentication. This is to ensure that every user sign-in is done using modern strong authentication. Authenticator Lite is embedded in Outlook client for iOS and Android platforms allowing users to request authentication and receive Time Based One Time Password (TOTP) codes. The feature is currently in the state ‘Microsoft managed.’ until June 9 after which it will be turned on by default. Which bring me us back to the topic of this blog. If you already have users registered for Microsoft Authenticator app, then you don't have to do anything and this post may not apply to you, however, if you are planning to use Auth...