How to configure and enforce multi-factor authentication in your tenant

Summary

In this video, Ahmad Yasin explains how to configure and enforce Azure Multi-Factor Authentication (MFA) to secure user authentication. He covers four primary methods to enable MFA: via Conditional Access Policy, Security Defaults, Per-User MFA, and Azure Identity Protection. The video provides step-by-step guidance on each method, including the required licenses and settings. Additionally, Ahmad discusses how to track and review MFA-triggering events using the Azure AD sign-ins blade, ensuring organizations can effectively manage and monitor security measures for their users' cloud services.

Takeaways

• 😀 MFA adds an extra layer of security by requiring users to provide additional identification forms, like a phone code or fingerprint scan.
• 😀 Azure MFA can be triggered through different methods, including conditional access policies, security defaults, per user MFA, and Azure Identity Protection.
• 😀 Conditional Access Policies allow admins to configure when MFA is required based on factors like users, apps, or locations, but it requires an Azure AD Premium license.
• 😀 Security Defaults provide an easy-to-implement, pre-configured security option that enforces MFA for all users, available with the free version of Azure AD.
• 😀 Users have 14 days to register for MFA after security defaults are enabled. If not completed, they will be blocked from signing in until MFA registration is finished.
• 😀 Per User MFA enables MFA on a user-by-user basis but provides fewer customization options and is included with Office 365 E3/E5 licenses.
• 😀 Azure Identity Protection helps automate detection and remediation of risky sign-ins, triggering MFA if necessary, and requires an Azure AD Premium P2 license.
• 😀 Admins can track MFA triggers using the Sign-ins blade in Azure AD, which provides detailed logs of user sign-ins and MFA events.
• 😀 Azure MFA may also be triggered by device registration, self-service password resets, or through third-party applications like ADFS (Active Directory Federation Services).
• 😀 Enabling MFA via conditional access provides admins flexibility to configure MFA requirements for specific cloud apps, sensitive data, or geographical locations.
• 😀 Enabling MFA through Azure Identity Protection allows for a dynamic, risk-based approach where MFA can be triggered based on the perceived risk of a sign-in attempt.

Q & A

What is multi-factor authentication (MFA)?

Multi-factor authentication (MFA) is a sign-in process where users are prompted for additional forms of identification, such as a code sent to their phone or a fingerprint scan, in addition to their usual password.

What are the common ways to enable MFA in Azure?

The common ways to enable MFA in Azure include using Conditional Access Policy, Security Defaults, per-user MFA, and Azure Identity Protection.

How does conditional access policy help enforce MFA?

Conditional access policies allow administrators to decide when MFA is required, based on specific users, applications, or conditions. For example, MFA can be required for access to sensitive apps like Exchange Online.

What is required to use conditional access policies for MFA?

To use conditional access policies for MFA, an Azure AD Premium license is required, with options for coverage under Azure Premium P2.

How can MFA be triggered through security defaults in Azure?

Security defaults in Azure make it easy to secure the organization by enabling MFA for all users. Users must register for MFA within 14 days, or they will not be able to sign in. These defaults are enabled in the Azure portal and are available for all users with an Azure AD basic or free license.

What happens after 14 days if users do not register for MFA under security defaults?

If users do not register for MFA within 14 days after security defaults are enabled, they will not be able to sign in until they complete the MFA registration process.

How can MFA be enabled on a per-user basis in Azure?

MFA can be enabled on a per-user basis by going to the Azure Active Directory blade, selecting users, and enabling MFA for individual users. This will require users to complete the MFA process whenever they access any cloud service.

What is the role of Azure Identity Protection in enforcing MFA?

Azure Identity Protection helps enforce MFA by triggering it when risky sign-in attempts are detected, based on configurable sign-in risk policies. This helps protect accounts from being compromised.

What license is required to use Azure Identity Protection?

Azure Identity Protection requires an Azure AD Premium P2 license, which also covers the MFA license.

Can admins track MFA triggers in Azure AD?

Yes, admins can track MFA triggers and the source of MFA requirements through the Azure AD sign-ins blade, which provides detailed information about each user sign-in attempt.