MFA Setup guide for Staff

[mdrabble]

Does anyone have a PDF/Word document MFA setup guide for staff?

 

Will be introducing it in September and trying to save reinventing the wheel if someone else has one

 

Cheers

[DaveTheTech]

Guide attached.

I usually give a TLDR version in the email and say a full guide is attached.

 

Go to http://aka.ms/mfasetup and login with your account.Then press the Add Method button.

Use the authenticator app - this is the recommended

Follow the on screen instructions.

 

Alternative ways are a call or text:Click the drop down for PhoneEnter your phone numberChoose either a call or a text

Set up the Microsoft Authenticator app V1.0.pdf

[bald_pig]

I basically copied this guide:

https://support.microsoft.com/en-us/topic/set-up-your-microsoft-365-sign-in-for-multi-factor-authentication-ace1d096-61e5-449b-a875-58eb3d74de14

[paulkerton]

Are you getting much pushback on it?

We're looking at rolling out 2SV for Google, but we're expecting a lot of push back, especially as we are no phones school, so if we go further than the office based staff we'd have to look at a hardware implementation rather than Authenticator apps.

[mdrabble]

SLT agreed to it after I forwarded on the NCSC warning about schools being targeted and they even said that more and more places are requiring MFA so most staff should be aware of it and possibly using it elsewhere.

 

School IP has been set as a trusted location so wont prompt for MFA.

 

Have set MFA for outside of school and to re-prompt every 60 days on devices they have signed in on and ticked stay signed in.

 

Have emailed all staff to warn them about the introduction of MFA from September - so far only IT Support use MFA for Office 365

 

From September all staff will require MFA for Office 365 and RDS when outside of school - and there will be no exceptions.

[Jawloms]

Is there a straight forward way to setup 2FA for staff but not students?

[localzuk]

Are you getting much pushback on it?

We're looking at rolling out 2SV for Google, but we're expecting a lot of push back, especially as we are no phones school, so if we go further than the office based staff we'd have to look at a hardware implementation rather than Authenticator apps.

We are in the middle of this process at the moment. We had 2 people push back, but they were convinced otherwise by the fact that the other 300+ staff don't mind.

 

We updated our policies to allow phones for work purposes - ie. specifically for this. We'd be looking at a 5 figure sum if we went with security keys, which we simply can't afford.

[TechMonkey]

Is there a straight forward way to setup 2FA for staff but not students?

 

In M365 you need to have a certain license so you can use Conditional Access. This also allows you to set it to only be used from home, rather than in school (though that depends on your position on MFA all the time or not)

 

Are you getting much pushback on it?

As we are local to the Skinners school that got hit I think staff were quite receptive, though most of them hadn't bothered to follow the instructions that had been sent and only realised once it was activated. We had already had management using it for about a month so they could at least say it wasn't much trouble and to just get on with it. We also set only on site activation of MFA to stop someone not setting it up and an attacker being able to setup MFA in their stead. As we are doing offsite only we have asked staff to setup on their own phones. Overall fewer issues than I thought but rather intense workload as a lot of staff can't read instructions.

Edited June 10, 2021 by TechMonkey

[DaveTheTech]

We had a couple of staff not wanting to use their phone in the slightest.

Installing the app on their school iPad was enough to make them happy.

 

Other options would be to use something like a Yubi key.

I would also suggest using named locations in the conditional access. That way it will only prompt when off of the schools' network.

[jnfarmer]

We're hoping to get our staff and maybe sixth formers on to MFA sooner rather than later, we've already got it set up for our MIS so hopefully it won't go down to badly. As others, we're going to put our location as a trusted network, just need to get it working for RDS, although we're moving over to Azure's WVD over the summer.