[ms office - o365] MFA Setup and Conditional Access

[argosanti]

Hi all,

 

I work in a MAT that's looking at deploying MFA across all of our staff users. We've initially ran a script to enable this manually using a CSV however now we want to be able to automate the MFA process for newly onboarded staff without having to do this manually. Microsoft have proposed Conditional Access as this prevents staff from having to enter 2FA codes within the classroom however as a result of adding the external IP as a trusted location, this bypasses the setup of MFA for new staff. This making it a security risk as if the account was compromised and MFA hadn't been configured then the bad actor could just configure the app codes to bypass MFA.

 

We have over 2500+ staff so we're looking at some sort of automation but so far the only help Microsoft have provided is to disable trusted locations or to ask staff to configure MFA upon first sign in manually by visiting the MFA setup link. Does anyone know of a way to automate the process so it changes the MFA status from Disabled to 'Enabled' so they are then forced to configure setting up MFA or any best practice on how to overcome this? We're keen to keep the trusted location as this then allows the staff to bypass MFA within the classrooms.

[chaplic]

I think you're doing this wrong on the assumption you have an azure P1 license

 

You don't need to setup indvidual users, just setup a policy that covers all user, targets office365 (or perhaps a sub component like yammer to test), excludes your named locations and also excludes a break-glass admin account. The policy should require MFA

[argosanti]

The issue is primarily that we're in a shared tenancy with another organisation and we don't want to turn on MFA for student accounts. The conditional policy we've configured is set to apply to a targeted AD group only. We utilise A1 Plus for Faculty for our staff licensing needs with only key teaching staff having A3 licenses.

[Boredguy]

We have gone down this route, and purchased EM&S A3 add-ons for all our different tenancies as part of our OVS-EES Agreement.

 

We have Conditional Access Rules setup that applies to just the Staff user group that are challenged to have either a MFA authentication or to be on a Hybrid Azure joined workstation (so that OneDrive etc does not prompt for authentication when logging in at work)

 

Students do not need to have MFA configured, and staff are prompted to setup their MFA details either via the Authenticator or SMS text message when they next try to login from a personal device.

 

But you do need a P1 licence as a minimum to enable Conditional Access MFA.

There is a powershell script available to update your users that were set to use legacy MFA across to the CA MFA

[argosanti]

We have gone down this route, and purchased EM&S A3 add-ons for all our different tenancies as part of our OVS-EES Agreement.

 

We have Conditional Access Rules setup that applies to just the Staff user group that are challenged to have either a MFA authentication or to be on a Hybrid Azure joined workstation (so that OneDrive etc does not prompt for authentication when logging in at work)

 

Students do not need to have MFA configured, and staff are prompted to setup their MFA details either via the Authenticator or SMS text message when they next try to login from a personal device.

 

But you do need a P1 licence as a minimum to enable Conditional Access MFA.

There is a powershell script available to update your users that were set to use legacy MFA across to the CA MFA

CA seems to be working okay but the major limitation for us is that the MFA bypass for trusted locations means that those who haven't configured MFA aren't prompted to do so on first sign in - unfortunately only way to fix this is by going to MFA in Azure AD and changing the entity from 'Disabled' to 'Enabled' this then prompts the user regardless of CA policies.

[chaplic]

CA seems to be working okay but the major limitation for us is that the MFA bypass for trusted locations means that those who haven't configured MFA aren't prompted to do so on first sign in - unfortunately only way to fix this is by going to MFA in Azure AD and changing the entity from 'Disabled' to 'Enabled' this then prompts the user regardless of CA policies.

Enable combined security information registration - Azure Active Directory | Microsoft Docs

 

 

You can set a requirement to setup MFA from a trusted location

[Boredguy]

CA seems to be working okay but the major limitation for us is that the MFA bypass for trusted locations means that those who haven't configured MFA aren't prompted to do so on first sign in - unfortunately only way to fix this is by going to MFA in Azure AD and changing the entity from 'Disabled' to 'Enabled' this then prompts the user regardless of CA policies.

 

There is a powershell script to convert all the legacy MFA credentials across to the CA MFA version and to reset the legacy MFA to disabled.

All of our staff have been prompted to set their MFA details if using a personal device in school, or when at home as our CA rules have no trusted IP addresses listed.

 

Users can still setup their MFA via the school workstations, but by going in through the My Account -> Security Settings route