#Modern Workplace

Microsoft is retiring SMS and voice authentication service in Entra ID on 1 February 2027. Also, from 1 September 2026 onwards, users enabled for SMS or Voice will be automatically migrated to passkeys and brought into the Passkey Registration Campaign. This means that when they next sign in and complete MFA, they will be prompted to register a passkey. Understandably, this has caused a lot of chatter in the technical community and I wanted to both understand this change and the possible impacts. Before strong authentication requirements as part of passwordless came into picture, organizations relied on SMS  or  Voice as authentication methods, that have now become legacy. There is no question are these authentication methods being less secure and why there is a need to move to stronger authentication methods, however, the migration needs to be carefully planned and also prepare for any surprised that may arise. One such area organisations need to consider is Self-Service P...

On May 26, 2023, Microsoft moved Microsoft Authenticator Lite App to General availability . Authenticator Lite was introduced to help organizations adopt alternative tool of authentication for users who had still not downloaded the full Microsoft Authenticator application for MFA, in an endeavor to enhance the security by moving from text message (SMS) and voice-based authentication. This is to ensure that every user sign-in is done using modern strong authentication. Authenticator Lite is embedded in Outlook client for iOS and Android platforms allowing users to request authentication and receive Time Based One Time Password (TOTP) codes. The feature is currently in the state ‘Microsoft managed.’ until June 9 after which it will be turned on by default. Which bring me us back to the topic of this blog. If you already have users registered for Microsoft Authenticator app, then you don't have to do anything and this post may not apply to you, however, if you are planning to use Auth...

Microsoft will be enabling number matching by default across all tenants starting May 8 2023 . "We will remove the admin controls and enforce the number match experience tenant-wide for all users of Microsoft Authenticator push notifications starting May 8, 2023. We highly recommend enabling number matching in the near term for improved sign-in security. Relevant services will begin deploying these changes after May 8, 2023 and users will start to see number match in approval requests. As services deploy, some may see number match while others don't. To ensure consistent behavior for all users, we highly recommend you enable number match for Microsoft Authenticator push notifications in advance." Number matching is a key security upgrade to traditional second factor notifications in Microsoft Authenticator. So it is a no brainer to have this enabled by default for all users. However, I will recommend enabling additional context together with number matching to improve sig...

Microsoft has defined a four-step approach to end the era of passwords:  Source: Microsoft As part of the passwordless deployment solution, T emporary A ccess P ass simplifies and secures the account onboarding experience for the end user. It also makes account access recovery easier by using time limited passcodes to sign in and then allowing the end user to re-register for a new strong authentication methods in situations where the user has lost or forgotten their authentication factors like a FIDO2 security key or Microsoft Authenticator app. In this blog I am going to cover the steps of enabling TAP and what the end user experience looks like when trying to recover an account. In order to sign in with a Temporary Access Pass, TAP needs to be enabled in the authentication method policy. Although one can create a Temporary Access Pass for any user, only those included in the policy can sign-in with it. Note: Only Global administrator and Authentication Method Policy administrato...