#Modern Workplace

  While working on an conditional access requirement involving authentication context, I stumbled upon protected actions in Entra ID and thought of blogging my thoughts and experience working with the feature. What are Protected actions? Protected actions are role permissions with Conditional Access applied for added security. Conditional Access requirements are enforced when a user performs the protected action, triggering a process that will require first satisfying the Conditional Access policies assigned to the required permissions. Because the policy enforcement occurs at the time the user attempts to perform the protected action and not during user sign-in or rule activation, users are prompted only when needed. Protected actions is currently in preview and can be applied to only a limited set of permissions spanning across the following areas: - Conditional Access policy management - Cross-tenant access settings management - Custom rules that define network locations - Prote...

  It's pretty normal for enterprise users contacting support team for password resets\recovery or perhaps doing it themselves using Self service password reset. However, in a passwordless environment, this can become a bit of a challenge because password will not normally be shared with the end users. If the organization is using Temporary access pass then it can be used for account recovery in general. I wrote a blog about this which you can refer to over here . This in turn should allow the end users to reset the PIN as well. It can be done right from the lockscreen, but the feature needs to be enabled first. If your devices are enrolled in Intune, then you can enable the feature using either the Identity Protection template or Account Protection Endpoint security policy. I am using Identity Protection policy to enable the feature as part of my overall Windows Hello for business configuration. Here is how you can do it. 1. Head over to Microsoft Endpoint Manager admin center . 2....

The default configuration for user sign-in frequency in Azure Active Directory is a rolling window of 90 days. But there are scenarios where organizations may require a fresh authentication every time a user performs specific actions. Based on customer feedback, Microsoft have introduced Sign-in frequency option Every time in addition to existing periodic frequency of hours and days. With this new capability, organization can now re-verify identity, device, and any other Conditional Access conditions for high-risk scenarios like - User risk  Session risk  Microsoft Intune device enrollment  I wanted to test this new feature for Intune enrollment and shall be covering my experience in this blog. Let's get started. 1. Head over to Microsoft Endpoint Manager admin center . 2. Select Endpoint Security > Conditional Access > New Policy. 3. Provide a Name. 4. Under Users and groups, choose Specific users included and select the users or groups that you want to targe...

With the recent spate of IT security breaches involving  #okta #mfafatigue  to name a few, the importance of implementing strong security measures has been put into question once again. Through this blog, I wanted to cover enabling Fraud alert as one of the counter measures, especially against MFA fatigue.  So what is MFA fatigue? In simple terms, MFA fatigue is tricking users into allowing device access due to overload of push notifications through Authenticator App. There are many ways one can about addressing this. Ideally organizations should consider going password-less by replacing push notifications with phone sign-in to thwart threats like MFA fatigue. In case this is not an option or the organization is not ready to implement it right away, then you can consider implementing fraud alert as a counter measure. What is a Fraud Alert? As the name suggests, the fraud alert feature lets users report fraudulent attempts being made to access corporate resources using th...

Picking up from my previous post on configuring and enabling MFA through registration campaign and conditional access policies , it is now time to address the requirement of configuring risk policies as part of over all implementation of Azure AD Identity protection feature. So what is a risk? Any suspicious action related to user accounts in the directory may be considered as a risk in Azure AD Identity protection. Identity Protection identifies risks under the following categories:  - Anonymous IP address  - Atypical travel  - Malware linked IP address  - Unfamiliar sign-in properties  - Leaked credentials  - Password spray Identity protection also supports automated remediation actions which can be tiggered in form of requiring users to perform Azure AD Multi-Factor Authentication, reset their password, self-service password reset, or blocking until an administrator takes action. There are some licensing requirements which need to be taken into considera...