#Modern Workplace

On May 26, 2023, Microsoft moved Microsoft Authenticator Lite App to General availability . Authenticator Lite was introduced to help organizations adopt alternative tool of authentication for users who had still not downloaded the full Microsoft Authenticator application for MFA, in an endeavor to enhance the security by moving from text message (SMS) and voice-based authentication. This is to ensure that every user sign-in is done using modern strong authentication. Authenticator Lite is embedded in Outlook client for iOS and Android platforms allowing users to request authentication and receive Time Based One Time Password (TOTP) codes. The feature is currently in the state ‘Microsoft managed.’ until June 9 after which it will be turned on by default. Which bring me us back to the topic of this blog. If you already have users registered for Microsoft Authenticator app, then you don't have to do anything and this post may not apply to you, however, if you are planning to use Auth...

Microsoft will be enabling number matching by default across all tenants starting May 8 2023 . "We will remove the admin controls and enforce the number match experience tenant-wide for all users of Microsoft Authenticator push notifications starting May 8, 2023. We highly recommend enabling number matching in the near term for improved sign-in security. Relevant services will begin deploying these changes after May 8, 2023 and users will start to see number match in approval requests. As services deploy, some may see number match while others don't. To ensure consistent behavior for all users, we highly recommend you enable number match for Microsoft Authenticator push notifications in advance." Number matching is a key security upgrade to traditional second factor notifications in Microsoft Authenticator. So it is a no brainer to have this enabled by default for all users. However, I will recommend enabling additional context together with number matching to improve sig...

Microsoft has defined a four-step approach to end the era of passwords:  Source: Microsoft As part of the passwordless deployment solution, T emporary A ccess P ass simplifies and secures the account onboarding experience for the end user. It also makes account access recovery easier by using time limited passcodes to sign in and then allowing the end user to re-register for a new strong authentication methods in situations where the user has lost or forgotten their authentication factors like a FIDO2 security key or Microsoft Authenticator app. In this blog I am going to cover the steps of enabling TAP and what the end user experience looks like when trying to recover an account. In order to sign in with a Temporary Access Pass, TAP needs to be enabled in the authentication method policy. Although one can create a Temporary Access Pass for any user, only those included in the policy can sign-in with it. Note: Only Global administrator and Authentication Method Policy administrato...

As part of my blogging series for implementing Azure AD authentication methods, I wanted to now cover passwordless authentication. Many organizations don't enable passwordless authentication because they think pins are less secure, but a username and password remains a primary attack vector and weak form of authentication that can be abused by bad actors through the means of social engineering, phishing, and spray attacks to compromise passwords.  A passwordless authentication strategy mitigates the risk of these attacks as the authentication methods are more convenient because the password is removed and replaced with something you have, plus something you are or something you know. Microsoft global Azure and Azure Government offer the following three passwordless authentication options that integrate with Azure Active Directory (Azure AD): Source: Microsoft In this blog, I will be covering the details on how to enable passwordless using Microsoft Authenticator App. The Microsoft ...