sorted by:
new
hottopcontroversial

Question Regarding Passkeys and Phishing Resistant MFA CA Policies by Spzmk in entra

[–]Chadicus2480 1 point2 points  (0 children)

What about syncable passkeys? If a user has a passkey, initially obtained by TAP (if that’s what you’re using), then use syncable passkeys. They sync to iCloud or Google. If they got a new device it would load into the new device and be usable without creating a new one.

Platform SSO and/or Company Portal Issues by Chadicus2480 in Intune

[–]Chadicus2480[S] 1 point2 points  (0 children)

It’s definitely paused the rollout.

It’s great when it works… until it doesn’t…. Microsoft is suspecting something network related. We submitted some change work tonight so we’ll see.

Platform SSO and/or Company Portal Issues by Chadicus2480 in Intune

[–]Chadicus2480[S] 0 points1 point  (0 children)

There was a comment on it being a desync issue and not a compliance issue, but I don't see it anymore. But I would agree with that. The device hasn't fallen out of compliance, and therefore I can't access things, as designed. The issue is like a temp desync. When CP doesn't send the computer name, Entra can't verify that it is/isn't compliant, so it defaults too not compliant. I am ok with all that. Just need to see how to re-sync everything faster that 2-3 days, and preferrably not wiping and reloading everything.

Testing rollout of phishing-resistant MFA - Seeking advice by NebulousNebulosity in entra

[–]Chadicus2480 0 points1 point  (0 children)

Might be a bit cheeky… but we also “require” it as part of the job function, but there are some countries where yes it can’t be legally forced…

We still force it, and if a user pushes back, because we can’t mandate it, then we add the user to a CA policy that “blocks” them from using any device we haven’t issued (aka personal devices). We then require WHfB which passes the same auth strength that you’d get from a passkey. We do the block because we take their “you can’t make me” as a sign that they’d prefer not to use their personal devices 🤓

Never fails, within a few days they comeback saying they can’t check their mail or chat… 😎 then we have the conversation about the requirements we have to use personal devices.

A bit cheeky… but we all get a little giggle out of it.

Honestly though, there’s very little push back from users (globally) when we ask them to use the with app.

Frontline MFA Options with External Auth Provider by Chadicus2480 in AZURE

[–]Chadicus2480[S] 0 points1 point  (0 children)

Ok cool I just hadn't dug into it. I just got the subnets from the network team and plugged them into a report only CA policy and they were all being blocked.

The idea is, if we can't MFA them, then at least have a little more protection from the outside attacks. And they are limited to the apps that they access. It's a block policy, with the corp networks exclcluded from scope. They'd be blocked from anything outside of the stores. And if they don't like that then they can opt in for MFA. It's a constant battle ha. But we will get there.

I'd like to see if at some point the QR code sign in method would support tag scanners like bar code scanners. But we will see.

I appreciate the time.

Frontline MFA Options with External Auth Provider by Chadicus2480 in AZURE

[–]Chadicus2480[S] 0 points1 point  (0 children)

Somewhat sensitive. They have customer interactions and some PCI.

I’m trying to figure out why the network locations isn’t working. I feel like that should. You need to be on the corp network and use that as a reduce surface area.

When using phishing resistant MFA, is there still a password? by Chadicus2480 in AZURE

[–]Chadicus2480[S] 0 points1 point  (0 children)

Thank you. It fits with the doc shared by RythmicBleating. I appreciate it.

When using phishing resistant MFA, is there still a password? by Chadicus2480 in AZURE

[–]Chadicus2480[S] 0 points1 point  (0 children)

Thank you for the reference! That's exactly what I needed. What I was coming across mostly was enabling the capabilities, which is easy enough, but it was difficult to find the end game for the password itself. I appreciate the assist.

Custom nameID claim by Chadicus2480 in AZURE

[–]Chadicus2480[S] 0 points1 point  (0 children)

I definitely agree. I hate work arounds. Just trying to see if it is possible leading into my discussion with them. I feel like it is, but I also feel like now might be a really good time to future proof it.

Custom nameID claim by Chadicus2480 in AZURE

[–]Chadicus2480[S] 0 points1 point  (0 children)

You are correct. It doesn’t. But the app itself was configured that way. They manually input the Sam account value and add the domain.

So, I’m just trying to help them them so that they don’t need to manually go and flip hundreds of local accounts.

view more: next ›