#Modern Workplace

Microsoft is retiring SMS and voice authentication service in Entra ID on 1 February 2027. Also, from 1 September 2026 onwards, users enabled for SMS or Voice will be automatically migrated to passkeys and brought into the Passkey Registration Campaign. This means that when they next sign in and complete MFA, they will be prompted to register a passkey. Understandably, this has caused a lot of chatter in the technical community and I wanted to both understand this change and the possible impacts. Before strong authentication requirements as part of passwordless came into picture, organizations relied on SMS  or  Voice as authentication methods, that have now become legacy. There is no question are these authentication methods being less secure and why there is a need to move to stronger authentication methods, however, the migration needs to be carefully planned and also prepare for any surprised that may arise. One such area organisations need to consider is Self-Service P...

The background.. Just a while back, Merill Fernando  (Product Manager at Microsoft) shared a post on LinkedIn about disabling SSPR for admin accounts. This was based off the recommendation on Maester  that  "Administrators with sensitive roles should use phishing-resistant authentication methods only and therefore not able to reset their password using SSPR." Now, with phishing-resistant authentication enabled, one may argue that there shouldn't be a need to disable SSPR for administrators, however, in my honest opinion it is still a good idea to disable SSPR for administrators as this will also align with both least privilege and zero trust model. But first, we are going to cover what all is involved in configuring Phishing resistant MFA. Enabling Phishing resistant MFA for Windows devices which uses Windows Hello for Business is pretty much an out of box functionality, but what about Apple devices like Macbooks that run on macOS? Let's find out.. Platform credentia...

If you follow @merill from Microsoft on X, then he recently shared a one pager on Microsoft Entra security capabilities . It caught my attention and I wanted to verify which all security features I had already implemented so far. While going through the list, I realized that I had actually left out on testing and understanding the end user behavior of one of the security capabilities i.e. Microsoft Entra Smart Lockout , and decided  to give it a go. Let's first see what is this feature all about. What is Smart lockout and how it works? Smart lockout helps in protecting against bad actors that try to guess passwords of end user accounts or use brute-force methods to get in. The feature can recognize sign-ins that come from valid users and treat them differently than ones of attackers and other unknown sources. By default, smart lockout locks an account from sign-in after 10 failed attempts in Azure Public and Microsoft Azure operated by 21Vianet tenants, while 3 failed attempts for...