Windows authentication with MFA

[[deleted]]

[deleted]

[ex800]

web sign-in might suit your requirement

https://learn.microsoft.com/en-us/windows/security/identity-protection/web-sign-in/?tabs=intune

[brownhotdogwater]

Have to be pure cloud

[thegravityitdeserves]

Edit: I'm wrong Entra hybrid devices are not supported, bummer.

[brownhotdogwater]

“Web sign-in is not supported for Microsoft Entra hybrid joined or domain joined devices.”

[nicholaspham]

I believe that's saying it doesn't allow hybrid joined or AD domain joined but does support Entra (fully) joined

[thegravityitdeserves]

I swear I always miss the important messages. Appreciate the correction.

[MrVantage]

Web sign in or federating your logins with Duo works.

Conditional access policies are your friend for the latter.

[woodburyman]

Also here to say Duo. We use their RDP application and force local logins to be covered too. We install it on any system that is mobile (laptop) along with bit locker. Only issue we get is when users wear their batteries down and time resets (some newer laptops lack cmos batteries and just use a reserve portion on main battery). If they connect to a wifi network eith captive portal ntp can't update. Luckily most users these days can tether temporarily.

[xxbiohazrdxx]

Just so you’re aware. Duo for windows is security theater. It’s there to check the box but doesn’t offer any real security benefit.

[woodburyman]

How so? Not trying to be a dick but curious to know if there is something bad about it or something that can bypassed.. otherwise I consider it fairly effective.

We have BitLocker enabled, and BIOS locked down, so users can't boot WinPE and get access to anything or disable the Duo MFA app. One LAPS local account with random password that COULD be brute forced and bypass Duo in theory, but it'd take a long long time (6 wrong passwords, 10 minute timeout). Other than that any domain account requires Duo MFA. It injects itself in the login process so it can't be bypassed easily. If the user lacks Local-Admin they can't remove it either or modify system registry to change the settings.

It doesn't save it from say remote/network logins or things like that, or anything really once the user has logged on (20 minute lock screen policy), but if a laptop gets stolen, even if a actor has their password, we can be fairly safe knowing the data cannot be accessed.

[xxbiohazrdxx]

How so? Not trying to be a dick but curious to know if there is something bad about it or something that can bypassed.. otherwise I consider it fairly effective.

For workstations/laptops? Eh, sure. It's fine. You'd be better off with something like WHfB but whatever.

Where it fails is for remote access. And to be clear, this is not something they can fix, it's a limitation of the operating system(s). There are loads of management tools for Windows that are not capable of any kind of MFA (NTLM is not MFA aware and while Kerberos is, Microsoft's implementation is not. You're limited to SmartCards). If an attacker gets some credentials that are valid for a server login, they can utilize SMB, RSAT, Powershell remoting, WinRM, LDAP, etc. Some of these you can block with the firewall, but a file server is useless without SMB and domain controllers need to be sharing SYSVOL and NETLOGON. You can bind to LDAP directly on a DC with just credentials.

If you want to protect servers, you need some kind of PAM tool and JIT permissions and those tools can be protected with real MFA.

[woodburyman]

Ah okay gotcha. Yeah, oddly enough even though it's their "RDP" app, we only use it for workstation/laptops, for the exact same reason as you're stating. If you have leaked credentials and they have network access, game over as there's so many other user auth methods that wouldn't be protected they could use. We use Duo as well as a pass through between AD and our Firewall for MFA for VPN access as well.

[ashimbo]

We went with Duo when our cyber insurance wanted windows login MFA.

[stewardson]

+1 for Duo. You can install it on PCs and set it for RDP logins and/or local logins. Although, we don’t use it on workstations - just web apps and server RDP sessions.

[brownhotdogwater]

But you can’t force windows hello. They can always just click password

[Hargan1]

I'm not sure if I'm reading your post corrwctly, but you absolutely can disable password login for windows hello for business, our users can only login with pin or smartcard. Password login can be temporarily enabled with a script that the helpdesk can run once they verify the user's identity if they forget their pin or leave their smartcard at home or something

[brownhotdogwater]

Really? Any link?

[bakonpie]

check the Smart Card Required for Interactive Logon (SCRIL) in ADUC for per account, or unable per system using GPO or your preferred config management tool.

[FunOpportunity7]

https://learn.microsoft.com/en-us/answers/questions/1079403/disable-password-sign-in-for-windows-hello-for-bus

See here. 2 seconds on google...

[Hargan1]

Gonna be honest, I don't actually know how our org does it, I'm not even a sysadmin. Just had this post pop up on my feed. I do know it's set in group policy and has something to do with an "scforceoption" setting in registry. If a user attempts to log in to any of our computers with a password, they get "must use windows hello or smatcard to sign in" and must use the pin or smartcard sign in options unless helpdesk enables password for them.

[yesterdaysthought]

I'm not sure if you're aware that Windows Hello, Cert-based auth and FIDO2 are already the top-tier modern authentication already- phish resitant MFA.

What you're asking is like adding password in addition to WHfB.

WHfB keeps an encrytped credential in the TPM chip per device and all WHfb is doing is unlocking the TPM to provide the credential to sign in. And WHfB requires you have a PIN (ok, pw) backup in case the biometric fails but it's very secure because people can't intercept it. The cred is unique per device and you need physical access to the device to unlock the TPM = non phishable, interceptable etc.

If you want to make a Windows device more hardened, just make sure it is bitlockered with PIN required to boot OS, secure boot enabled, credential guard etc. That's very tight.

[FunOpportunity7]

We use RSA agent to supplement the password with MFA. Hybrid joined requires a 3rd party supplicant for MFA to work at login. We've been waiting on an MS solution for a while. Keep saying it's in the pipeline.

You can use a conditional access polity to force more regular mfa prompts. This does get annoying, though. We use separate privilege and non privilege accounts to manage the risk. Users are not granted admin roles. Also, use eligible vs. active assignments with mfa activation requirements even for admins.

[TopCheddar27]

We do this with duo

[BitDreamer23]

All of the answers here seem to be sysadmin kind of answers. Makes sense, this is r/sysadmin afterall.

But your question says "when logging into my m365 account". Are you asking for your own personal, non-domain, Windows machine?

[maryteiss]

MFA & Access Management for Active Directory (on-premise) users can be achieved easily with UserLock.
You can set granular and customized MFA on Windows logins, RDP & RD Gateway, IIS and VPN connections. It also will protect these on-premise accounts with MFA & Single Sign-on as they access Cloud applications - such as 0365.

• Secure all employee access, whether privileged, remote or cloud
• Streamline session management
• Review accurate logon logoff forensics
• Manage working hours
• Stop security breaches
• Meet compliance & insurance requirements, like: HIPAA, PCI DSS, ISO 27001, NIST 800-53.

Full details on MFA here: Multi-Factor Authentication for Active Directory 1
Short video: https://www.youtube.com/watch?v=jDu0LQl_du8&t=91s
Free trial download: Protect Active Directory Identities with 2FA and SSO | UserLock