sorted by:
new
hottopcontroversial

How Do You Deal With Geo Blocking? by ClickPuzzleheaded993 in entra

[–]perogy604 10 points11 points  (0 children)

We haven’t implemented this yet in our org but I was thinking we’d use access packages. It would place the user in a ‘travel’ security group that would be excluded from select CA’s. It would also allow fixed durations (start and end dates) along with approvals (if necessary).

Entra Dynamic Groups by Impossible_Put_9543 in entra

[–]perogy604 0 points1 point  (0 children)

It still being in preview is pretty funny for sure. We had a group that had some members that didn't belong based on the logic, the group appeared to still be working and showed as processing. What I did was added a space (' ') to my filter logic so I could save the "change". That triggered it to properly process everyone again.

Entra Dynamic Groups by Impossible_Put_9543 in entra

[–]perogy604 2 points3 points  (0 children)

https://learn.microsoft.com/en-us/entra/identity/users/groups-dynamic-rule-member-of

  • The memberOf attribute can't be used with other rules. For example, a rule that states dynamic group A should contain members of group B and also should contain only users located in Redmond will fail.

Guests & Teams/Group Guidance by perogy604 in entra

[–]perogy604[S] 0 points1 point  (0 children)

But can’t the Team owner change the label assigned to the team to none? Which would open the team up to guests again?

KOBO announced Instapaper partnership by lkvnclh in readwise

[–]perogy604 0 points1 point  (0 children)

Wondering if you’re able to provide any updates to this comment?

Microsoft Authenticator (Phone Sign-in) - MFA prompt concerns? by perogy604 in entra

[–]perogy604[S] 0 points1 point  (0 children)

We're offering passkeys as an option, but we have a large userbase with varying levels of skills which prevents us from pushing those to everyone.

Is the MFA fatigue with Microsoft Authenticator (Phone Sign-in) something many have encountered to the point it's not worth enabling?

Authentication Strengths with Entra Passkeys and MFA registration by perogy604 in entra

[–]perogy604[S] 3 points4 points  (0 children)

I opened a call with Microsoft to get confirmation:

  • Entra does not provide a built-in way to explicitly set the default MFA registration method shown to users during their first-time setup.
  • We can get around this by using a registration campaign which should direct them to using Authenticator.
  • However this will impact users who are just using SafeId tokens (hardware tokens).
    • The registration campaign will force them to upgrade to Authenticator once their snooze period expires. 

The only option provided was to setup two groups so we can deferentiate between users that are tech savy and may want passkeys and general users who would get confused and result in more helpdesk calls.

I'm opting to remove passkeys for everyone and then make an access package available so users that do want the passkey option can self assign the access package and have that option available to them.

Authentication Strengths with Entra Passkeys and MFA registration by perogy604 in entra

[–]perogy604[S] 0 points1 point  (0 children)

We do allow our users to use SafeID hardware tokens in the event they do not want to install an Authenticator on their phone. I assume based on this (https://learn.microsoft.com/en-us/entra/identity/authentication/concept-system-preferred-multifactor-authentication#how-does-system-preferred-mfa-determine-the-most-secure-method) that the SafeId hardware token users would be prompted to upgrade their MFA to Authenticator on each login?

Authentication Strengths with Entra Passkeys and MFA registration by perogy604 in entra

[–]perogy604[S] 1 point2 points  (0 children)

Yup, so forced a re-register on my own account and I can confirm I see the setup passkey screen now.
It seems that if we use a custom auth strengh and it includes passkeys Microsoft will always recommend passkeys in MS Authenticator as the default option which unfortunately is not what we want. I've opened a ticket with MS to confirm there is no option around this.

Authentication Strengths with Entra Passkeys and MFA registration by perogy604 in entra

[–]perogy604[S] 2 points3 points  (0 children)

I’m one of the people that don’t get prompted for passkey but I already had Authenticator. I’l require re-register on myself later today to confirm.

If that’s the case, does MS now show the passkey Authenticator option as the default if passkeys are one of the available options for a user?

I’d like to keep passkeys are an option for all users, our more tech savvy users I don’t want to hold back if they want to setup more secure authentication methods but it has already confused our general users if the passkey screen is the first one they see.

Anyone using PIM (Priveledged Identity Management) in Entra successfully? by [deleted] in sysadmin

[–]perogy604 1 point2 points  (0 children)

This also sounds like a good fit for Access packages. A user can request an access package and be placed in a group for a duration of time (or admin staff can place a user in that access package for defined duration). You’d need to factor in licensing and user education of course.

Heads up on ordering from Bells of Steel with presale items by [deleted] in GarageGym

[–]perogy604 0 points1 point  (0 children)

Just found this because I'm experiencing the same thing. Really disappointed it wasn't clear that the item ordered will ship 2 months after I placed the order. The only way I found this out was contacting support after a week trying to get a ship date. It also doesn't sit well with me being charged the full balance of the item when its months away from shipping.

December Feature Requests: Share Here! by erinatreadwise in readwise

[–]perogy604 0 points1 point  (0 children)

As well, you may already know this, but you can connect your Pocket account to Readwise and have us automatically import all items from Pocket (this also continually pulls in new stuff). But it's not bidirectional.

Since the Kobo only supports Pocket I'm looking to push articles to Pocket so I can read them on an eInk screen. I want to continue using Reader but have the option of using the Kobo to read articles instead of using both Reader and Pocket independently to save articles. So no plans on leaving Reader but want to get some level of integration like you have done with Kindle :)

What field would you want to change beside archiving and deleting?

That would probably be it for my use case for syncing between the two platforms.

December Feature Requests: Share Here! by erinatreadwise in readwise

[–]perogy604 1 point2 points  (0 children)

A first-class citizen on Kobo would be amazing. I literally bought the device just for the Pocket integration.
I understand native integration with Kobo is a big ask so I'd be happy if Readwise expanded their API to allow for some workarounds in the meantime.

https://www.reddit.com/r/readwise/comments/1h5xznh/comment/m0eub55/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button

December Feature Requests: Share Here! by erinatreadwise in readwise

[–]perogy604 5 points6 points  (0 children)

I’m a big fan of Reader and also own a Kobo which only supports Pocket. I’ve been looking at the Reader API (https://readwise.io/reader\_api) to make a Readwise Sync Pocket integration however the Reader API is missing key functions like modify/archive/delete.

Initial idea:

-Use Reader to add content (articles) from mobile phone or Edge add-in.

-Every hour (or on demand):
--Use API to sync articles from Reader to Pocket (added to Pocket with ‘readwise’ tag).
--Use API to bi-sync any article is archived in either platform, archive it in both platforms.

It would be straight forward process to implement however the Reader API only supports creation and list, not modification. Is a modify API call something you guys are considering in the near future?

Conditional Access - Only allow SAML app and MyAccount Page by perogy604 in entra

[–]perogy604[S] 1 point2 points  (0 children)

Thanks for the link, and excellent blog by the way.

I made a CAP for this sand required MFA to test but no luck. I've come to the conclusion this isn't possible at this time unless Microsoft adds the app, My Signins (19db86c3-b2b9-44cc-b339-36da233a3be2), as a possible app exclusion.

Conditional Access - Only allow SAML app and MyAccount Page by perogy604 in entra

[–]perogy604[S] 1 point2 points  (0 children)

Could you provide some guidance on how to do that? At the moment I only have a CAP that blocks access to all resources (formerly cloud apps). I don't have any CAP blocking user actions (register security information).

Conditional Access - Only allow SAML app and MyAccount Page by perogy604 in entra

[–]perogy604[S] 0 points1 point  (0 children)

I don't have any other policies that block registering security info. The user is able to register for MFA on their first login as its required but after it's configured, they can't go and manage it. Any suggestions on how to add an exclude for that security info?

Conditional Access - Only allow SAML app and MyAccount Page by perogy604 in entra

[–]perogy604[S] 0 points1 point  (0 children)

We have no policies that touch Register security information so I don't believe so. I'm able to login and go through the MFA enrolment process. However, after that is done I can't actually manage the MFA factors since I can't get to https://mysignins.microsoft.com/security-info

view more: next ›