2FA

[Uber22]

Hey

 

I was looking to implement 2fa for anyone using there personal phone or device outside the school is this possible .

[DalekSec]

What service do you want 2FA setup for? Also worth bearing in mind some people don't want to use their person phones for work stuff, we had to provide some staff with 2FA tokens (the name alludes me atm) that they use instead of their phones.

[Uber22]

Sorry my bad , office 365 as we use SharePoint for a lot of data. How do you generate the tokens

[Arthur]

How do you generate the tokens

I think @DalekSec means hardware security keys.

 

To do what you want you are going to need Azure AD Premium P1 licenses and setup conditional access.

 

https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks

[DalekSec]

Sorry my bad , office 365 as we use SharePoint for a lot of data. How do you generate the tokens

 

I think @DalekSec means hardware security keys.

 

Yeah sorry that's what i meant, i didn't set this up my director did but we use these kinda things for users who don't want to use their phones:

 

https://www.protectimus.com/slim-mini/?ref=Office-365-MFA-token-article-button

[Uber22]

I don't have my P1 licences yet we are moving from A1 and office pro plus to A3 witch they are telling me comes with P1

[Brixy]

Microsoft do support oath based hardware tokens now;

https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/hardware-oath-tokens-in-azure-mfa-in-the-cloud-are-now-available/ba-p/276466

 

to use the standard tokens you will need a P1 or P2 license, if this is not the case then you will need to use a programmable token (you can find both types of hardware tokens here). I would suggest sticking to TOTP tokens as they are more secure. FIDO keys could also be considered, but these tend to be more expensive (plus you will need to check your protected app supports them).