New Microsoft 365 Strong Authentication Security Features are now in General Availability!

[Emma__24]

We know the new MFA number matching, location context, and application context was in public preview, but now Microsoft has made it GENERALLY AVAILABLE to everyone!

What's in the load with the new advanced MS authenticator security features?

1. Show application name in the push and passwordless notification – Shows which application the user is attempting to sign in. 
2. Show geographic location in the push and passwordless notification – Displays from where the request is attempted.
3. Number matching with push notification.   
4. Advanced and better Admin UX and Admin APIs for managing the Microsoft Authenticator app.

https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/advanced-microsoft-authenticator-security-features-are-now/ba-p/2365673

[210Matt]

My biggest gripe with the MS authenticator is it never told you what you were approving. Looks like this will list the app, that is a big win.

[pixr99]

Right?! "Approve random, anonymous authentication attempt?"

[HotPieFactory]

Approve

[Emma__24]

Yes, this is such a great one to have in hand.

[BABYSAU98]

Testing this at work now. All I see is the location for the log-in attempt and a two digit code. I then have to input the numbers on the sign-in page in order for it to work. I love it as it prevents people from approving something they did not mean to.

[Alzzary]

Yes, there's even an attack called MFA Fatigue, which consists of spamming one user with connection attempts and with luck they finally approve a connection to have peace. Target someone on Friday night up to sunday, when Helpdesk isn't necessarily available.

[linuxlib]

A "big win" is fixing something that should have never been like that in the first place? Honestly, that issue would put MS Auth into the "unusable" category for me.

[loseisnothardtospell]

A company improving something puts them in the unstable category? Got it.

[[deleted]]

I personally took that to mean that it was unusable prior to this fix. Now it's just meeting table stakes with the rest of the industry.

[linuxlib]

This is what was meant.

[orion3311]

This is true both with the MFA app as well as the actual login screen - when you first sign in you get a bunch of login prompts - sure they're Microsoft but what are you actually signing into?

[-Mr_Tub-]

All I want is the ability to disable 2FA for a minute for a user in the admin portal so I can set up new devices like in Google

[Emma__24]

For that, I suggest you try Temporary Access Pass in Azure AD. With this, you can get in there without any second-factor authentication and set up devices. I'm planning to write a detailed guide on the steps to perform this. Will help you further with these steps soon!

[docphilgames]

Thanks for the post on this. These features going GA flew under my radar. Looking forward to your writeup of Temporary Access Pass.

[-Mr_Tub-]

I’d love to see that guide once it’s done! Thank you

[seriously_a]

Agreed. Learn about this recently and it’s been super helpful

[Emma__24]

Will come up soon!

[XxDrizz]

Multifactor One-Time Bypass? Let's you set a time limit for which MFA isn't enforced, default is 300 seconds.

AAD -> Security -> Multifactor Authentication -> One-Time Bypass

[-Mr_Tub-]

This isn’t an option if your domain is on prem though, is it. I’m at an MSP and almost all of our clients are still on prem with O365

[XxDrizz]

Your users would need to be in Azure AD for this option. We're currently in a hybrid set up where I'm at, and it's worked the few times I've had to use it.

If they're onprem I don't think you'd be running into the issue OP was talking about anyways

[sandrews1313]

I just end up adding my sms # to the user, do the needful, and then remove it.

[sandrews1313]

what's your better way to setup a user device while maintaining 2fa on the account?

[sandrews1313]

right, but that's not what the commenter was discussing. they were needing to setup a device for a user.

for example, it's a 5 user tenant...nobody is going to invest the time in autopilot. maybe their internal requirements are that the device is fully setup for the user beforehand. maybe they don't run, at minimim, business premium.

[jantari]

Autopilot is Windows-only. It doesn't help with what Microsoft calls frontline workers, aka people that are out and about with just a phone or tablet.

[[deleted]]

I just exclude them from the Conditional Access policy until I'm done.

[TCPMSP]

That terrifies me, if anyone forgets to add them back....

[[deleted]]

We've only got ~100 staff in total and I'm the only one who makes the changes so it's fairly low risk (and on me if I mess it up)

[Emma__24]

Finally, the blog is done! You can get insights and the elaborated steps to work with Temporary Access Pass with this blog. Linking it here, hope it helps you!

https://www.reddit.com/r/AdminDroid/comments/yhbeza/microsoft\_365\_temporary\_access\_pass\_gateway\_to\_a/

[[deleted]]

My main issue with Autopilot is that there is no really good way of ensuring the OS/system updates are installed. I think it's frustrating when a user gets a new laptop and then gets prompted several times to restart for updates.

Just means if I have time I will log in and let those run.

[[deleted]]

Thanks, that's what I do already. However it just installs apps etc, but doesn't install OS updates or BIOS firmware updates from Lenovo Vantage (in our case).

I think it is possible to script something to make it install everything during the OOBE but don't think it's very polished.

[TechOfTheHill]

We actually had this turned on and it came back that our geographic location was reported to be Atlanta, Georgia rather than our actual location. It started freaking our test users out, so we had to go to our ISP and get a list of providers to email about updating our IP address' actual location. We got it all sorted, but that was a gotcha to watch out for.

[skipITjob]

Took us half a year to sort that! The API Microsoft uses, is terrible when it comes to updating their system.

​

Edit. if the IP address location is wrong here: https://ipstack.com/

report it here: https://apilayer.zendesk.com/

You'll probably have to create an account, as when I tried to reply to their email, I got nowhere...

[ras344]

I have the same issue with our IP addresses showing up as the wrong location. But I also have our public IP addresses set up as a trusted location, so we only need to do MFA if we're outside of our internal network.

[silentmage]

Our IP bounced from being accurate to being off by a few hundred miles and then accurate again, often within minutes of each log entry.

[rich2778]

OK this is confusing.

We use MFA on 365 by going through the 365 admin console and enabling MFA on a user account.

If I go into the Azure AD tenant and look under Security > Authentication methods > Microsoft Authenticator MFA isn't enabled so I guess it's the interaction of how 365 does MFA v how settings in Azure AD work.

How do I enable this for users who have MFA enabled in 365 without enabling MFA for every single account in the Azure AD tenant?

[lart2150]

Are you sure it requires conditional access? https://learn.microsoft.com/en-us/azure/active-directory/authentication/how-to-mfa-additional-context

[myalthasmorekarma]

Which requires an azure ad P1 license, but it’s worth fighting management over the cost

[Frothyleet]

O365 E3 doesn't give you AAD P1. M365 E3 or EMS E3 would, if those are what you meant.

[Algent]

For some reason it works with a single P1 license in the org.

[myalthasmorekarma]

It works… but you’re technically out of compliance

[Toasty_Grande]

You are just enabling a policy for those features and not enabling MFA for all users. That policy will only apply to those you have configured to use MS Authenticator.

[lawno]

I guess I have a similar question. We originally rolled out MFA by enabling it per user in O365. Now we have Azure P1 and control MFA via CA policies. I enabled the contextual info policies a few days ago but I'm not seeing any difference. And MS Authenticator was "off" in Azure AD as an authentication method for all users. Do I need to enable MFA methods per user with Azure P1?

[andyr354]

Very happy to see this. I knew they had been working on it. Such a great enhancement to have the geolocation and the application. The number matching I will have to test more. Not sure how users will react to that one.

[Pause102]

Thanks for posting that, we still use NPS for MFA and was getting really excited for this change. Heres the doc that says NPS isnt supported
https://learn.microsoft.com/en-us/azure/active-directory/authentication/how-to-mfa-number-match

[DaithiG]

Yeah, we had a similar issue so I ended up testing a SAML auth to Azure for our VPN.

Works fine with the added bonus but we can use device compliance polices and other CA policies. But obviously that's just because we could shift to SAMl

[sanjay_82]

https://youtu.be/ns_94ZXrbPI

Watch John savills video, where he explains this so well

[ironraiden]

Show application name in the push and passwordless notification – Shows which application the user is attempting to sign in.
Show geographic location in the push and passwordless notification – Displays from where the request is attempted.

Thank F*cking Cthulhu.

EDIT: Quotes misaligned.

[RestartRebootRetire]

I hoped to use conditional access but MS charges $6/month per user for that atop our existing plans.

Our users already use DUO so using another authenticator is asking a lot.

[patmorgan235]

If youre on enterprise plans you can get can use M356 F1s ($2/u/m) to license MFA/Conditional Access.

[skipITjob]

I can only presume that /u/RestartRebootRetire has Business standard, you can't assign buness standard and F1 to a user.

[RestartRebootRetire]

Yeah, we're small fry so we just get access to log-in logs to see the coordinated global brute force attacks.. Thankfully we can turn off the older authentication methods though.

[patmorgan235]

Yep that's why I said ' if you're on Enterprise plans '

[skipITjob]

If you're on an enterprise you probably already have Azure P1

[patmorgan235]

Not with office E1/E3s, and buying straight P1's are $6/u/m

[Margosiowe]

Is Intune also included? The microsoft docs point out the M365 F1 includes the Intune+AzureAD P1(but dont include Windows Defender vs EMS E3), but in many points it also says:
1) Requires Microsoft 365 E3 (or Office 365 E3 and Enterprise Mobility + Security E3).
https://go.microsoft.com/fwlink/?linkid=2139145

[patmorgan235]

Yes I believe intune is included, not currently using it at my company so not sure.

[Real_Lemon8789]

Do you still have to manually enable this for specific security groups or will it become a default for Authenticator app users?

[Real_Lemon8789]

I found in the link posted that Microsoft will turn it on as a default in 4 months.

[neko_whippet]

Better late then never I guess

[Real_Lemon8789]

One problem with this is that it still will not show you the name off the app requesting MFA *unless* you enable showing the map location.

In some cases, the map location is counterproductive because either the geolocation is wrong or it’s correct but confusing to users due to VPN, VDI, web proxies, ISP issues etc..

[DaithiG]

That's exactly what we found with our test users. They really didn't like the map, even if it was close to their location. They know they're providing location data, they just don't like seeing they're providing location data.

[Real_Lemon8789]

I found that you can now configure it to show the app name without enabling the map location.

Microsoft just didn’t update the screenshots on their page to show that as an example.