#Modern Workplace

Microsoft Entra makes passwordless registration easier, but what does this mean for Zero Trust? Let's discuss.. Microsoft recently  published  a message in the message center that covers details on Windows Hello for Business and macOS Platform SSO supporting standalone MFA factors. It is well established that Passwordless authentication is becoming the default approach for modern identity security. Windows Hello for Business (WHfB), passkeys, FIDO2 and macOS Platform SSO (PSSO) all provide stronger authentication while reducing our dependency on passwords. And with this new change, Microsoft has now made passwordless registration in Entra ID easier, including bringing register security information further into the conditional access model. However, this does raise an interesting question: If passwordless authentication is strong enough to authenticate the user, do we still need MFA? In my personal opinion, it is still necessary, but not necessarily in the way we traditionally ...

For the last couple of days, I have been working on securing my own tenant and as a result of this, I wanted to enable passkeys for all my test accounts. Passkeys (FIDO2) not only improves productivity and provide better security, but also make the authentication process seamless by eliminating the need for entering a username or password. This can be achieved through both FIDO2 security key and Microsoft Authenticator. Due to this fact, Microsoft and its partners are investing in both synced and device bound passkeys for work accounts. However, and during my own testing, enabling passkey on the user's side can go into a loop when trying to add a passkey in Microsoft Authenticator application. This may not be a case for every tenant, but if you have conditional access policies created that specifically leverage phishing-resistant authentication strength, then you will most likely run into this issue. Luckily there are some work arounds available and require further actions. In this...

  It's pretty normal for enterprise users contacting support team for password resets\recovery or perhaps doing it themselves using Self service password reset. However, in a passwordless environment, this can become a bit of a challenge because password will not normally be shared with the end users. If the organization is using Temporary access pass then it can be used for account recovery in general. I wrote a blog about this which you can refer to over here . This in turn should allow the end users to reset the PIN as well. It can be done right from the lockscreen, but the feature needs to be enabled first. If your devices are enrolled in Intune, then you can enable the feature using either the Identity Protection template or Account Protection Endpoint security policy. I am using Identity Protection policy to enable the feature as part of my overall Windows Hello for business configuration. Here is how you can do it. 1. Head over to Microsoft Endpoint Manager admin center . 2....

Microsoft has defined a four-step approach to end the era of passwords:  Source: Microsoft As part of the passwordless deployment solution, T emporary A ccess P ass simplifies and secures the account onboarding experience for the end user. It also makes account access recovery easier by using time limited passcodes to sign in and then allowing the end user to re-register for a new strong authentication methods in situations where the user has lost or forgotten their authentication factors like a FIDO2 security key or Microsoft Authenticator app. In this blog I am going to cover the steps of enabling TAP and what the end user experience looks like when trying to recover an account. In order to sign in with a Temporary Access Pass, TAP needs to be enabled in the authentication method policy. Although one can create a Temporary Access Pass for any user, only those included in the policy can sign-in with it. Note: Only Global administrator and Authentication Method Policy administrato...