#Modern Workplace

The background.. Just a while back, Merill Fernando  (Product Manager at Microsoft) shared a post on LinkedIn about disabling SSPR for admin accounts. This was based off the recommendation on Maester  that  "Administrators with sensitive roles should use phishing-resistant authentication methods only and therefore not able to reset their password using SSPR." Now, with phishing-resistant authentication enabled, one may argue that there shouldn't be a need to disable SSPR for administrators, however, in my honest opinion it is still a good idea to disable SSPR for administrators as this will also align with both least privilege and zero trust model. But first, we are going to cover what all is involved in configuring Phishing resistant MFA. Enabling Phishing resistant MFA for Windows devices which uses Windows Hello for Business is pretty much an out of box functionality, but what about Apple devices like Macbooks that run on macOS? Let's find out.. Platform credentia...

If you follow @merill from Microsoft on X, then he recently shared a one pager on Microsoft Entra security capabilities . It caught my attention and I wanted to verify which all security features I had already implemented so far. While going through the list, I realized that I had actually left out on testing and understanding the end user behavior of one of the security capabilities i.e. Microsoft Entra Smart Lockout , and decided  to give it a go. Let's first see what is this feature all about. What is Smart lockout and how it works? Smart lockout helps in protecting against bad actors that try to guess passwords of end user accounts or use brute-force methods to get in. The feature can recognize sign-ins that come from valid users and treat them differently than ones of attackers and other unknown sources. By default, smart lockout locks an account from sign-in after 10 failed attempts in Azure Public and Microsoft Azure operated by 21Vianet tenants, while 3 failed attempts for...

As part of my blogging series for implementing Azure AD authentication methods, I wanted to now cover passwordless authentication. Many organizations don't enable passwordless authentication because they think pins are less secure, but a username and password remains a primary attack vector and weak form of authentication that can be abused by bad actors through the means of social engineering, phishing, and spray attacks to compromise passwords.  A passwordless authentication strategy mitigates the risk of these attacks as the authentication methods are more convenient because the password is removed and replaced with something you have, plus something you are or something you know. Microsoft global Azure and Azure Government offer the following three passwordless authentication options that integrate with Azure Active Directory (Azure AD): Source: Microsoft In this blog, I will be covering the details on how to enable passwordless using Microsoft Authenticator App. The Microsoft ...

On March 29 2022, Microsoft released MC348869  as a major update in Microsoft 365 Admin message center. The update states that registration for both MFA and SSPR will be combined as a default to give a unified experience to the end user. The change is expected to begin rolling out early October 2022 across all tenants. Note: This change will not impact tenants created after August 2020 or if the tenant is located in China. From an admin perspective nothing should be required when this change starts to roll out, however, there will be a change in the registration process experience for end users. If this is important to you then you can test this setting right away and make necessary amendments in the end user registration processes. There are two modes for combined registration - 1. Interrupt mode - It is a wizard-like experience, presented to users when they register or refresh their security info at sign-in. 2. Manage mode  - It is part of the user profile and allows us...