#Modern Workplace

Microsoft is retiring SMS and voice authentication service in Entra ID on 1 February 2027. Also, from 1 September 2026 onwards, users enabled for SMS or Voice will be automatically migrated to passkeys and brought into the Passkey Registration Campaign. This means that when they next sign in and complete MFA, they will be prompted to register a passkey. Understandably, this has caused a lot of chatter in the technical community and I wanted to both understand this change and the possible impacts. Before strong authentication requirements as part of passwordless came into picture, organizations relied on SMS  or  Voice as authentication methods, that have now become legacy. There is no question are these authentication methods being less secure and why there is a need to move to stronger authentication methods, however, the migration needs to be carefully planned and also prepare for any surprised that may arise. One such area organisations need to consider is Self-Service P...

Microsoft Entra makes passwordless registration easier, but what does this mean for Zero Trust? Let's discuss.. Microsoft recently  published  a message in the message center that covers details on Windows Hello for Business and macOS Platform SSO supporting standalone MFA factors. It is well established that Passwordless authentication is becoming the default approach for modern identity security. Windows Hello for Business (WHfB), passkeys, FIDO2 and macOS Platform SSO (PSSO) all provide stronger authentication while reducing our dependency on passwords. And with this new change, Microsoft has now made passwordless registration in Entra ID easier, including bringing register security information further into the conditional access model. However, this does raise an interesting question: If passwordless authentication is strong enough to authenticate the user, do we still need MFA? In my personal opinion, it is still necessary, but not necessarily in the way we traditionally ...

I recently encountered an issue as part of a project involving Entra hybrid join for existing domain joined devices and Co-management where devices stopped connecting to corporate wireless access points automatically. The devices would complain about missing credentials, resulting in authentication errors and eventually give up on connecting to the corporate Wi-Fi. Here is a snapshot of one such error - The environment is configured with Cisco ISE as the RADIUS solution with an authentication policy relying on PEAP MSCHAPv2 as the authentication protocol. The logs on the Cisco side reflected the same ' Internal authentication error ' as seen in the event viewer of the endpoints. This was strange at first because there was nothing set up in Intune or otherwise as part of the Co-management configuration that would interfere with the WiFi settings in general. On further investigation, it was discovered that the issue could very well be related to Credential Guard on the devices. ...

There are many options available for deploying Windows Hello for Business, ensuring compatibility with various organizational infrastructures. For cloud-only organizations, the implementation is simple and works straight out of the box. However, for Hybrid based models, where most organizations operate, there are can be some additional configurations requirements. Out of the available trust types - Cloud Kerberos, Key or certificate, Cloud Kerberos is the easiest and also the Microsoft recommended trust type. It allows users to authenticate to Active Directory by requesting a TGT from Microsoft Entra ID, using Microsoft Entra Kerberos. This way the on-premises domain controllers remains responsible for Kerberos service tickets and authorization. Which brings me to the reason behind writing this blog post. I recently assisted a customer with an issue involving Windows Hello for Business authentication while accessing on-premises resources like file shares. The end user experience was so...

Enrolment time grouping for Android Enterprise is finally here. I had been using it for Autopilot Device Preparation (APDP) and now that it supports Android OS, I wanted to experience it first hand and capture all the caveats or gotchas. For those who are not familiar with the feature, enrolment time grouping was first introduced for Windows OS as part of Autopilot Device Preparation to speed up app and policy provisioning during device enrollment. The feature allows enrolment time grouping when you can add a Microsoft Entra security group in the enrolment profile so that devices are added to the group during enrolment, rather than after. This pre-knowledge of the security group that the device will become member of after enrollment enables Intune to deliver the configurations to the device quickly on enrollment, not only reduces post-enrolment latency but also improves productivity. If you don't configure enrolment time grouping, then Microsoft Intune can only determine the apps a...