July MFA needed for all azure users?

[rheibel]

Hoping this is a badly worded blog post but do others read this as all school students will need MFA mobile app or FIDO2 usb? If anyone has a decent contact at Microsoft can they reach out and see if I need to be ordering mass FIDO2 keys for September?

 

 

https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/microsoft-will-require-mfa-for-all-azure-users/bc-p/4141341

[Olliedawg]

Lots of lovely replies to that post - as expected, Micro$oft are never specific enough with things like this.

[pablo007]

Do students use Azure? is this specific to azure there is no mention of Microsoft 365 (office apps email etc) so i hope and pray this is just for those logging on to the azure portal..

[ITGuyNW]

Why Azure and not Entra?

[RobFuller]

I'm reading this as only effecting the Azure platform not all 365 apps, would you agree?

[robintech]

This seems to happen every year but they always back down and clarify tenants can opt out.

[free780]

Microsoft seem to be the masters in not being able to communicate clearly. I suspect there may be a push to MFA for all users. However if you have P1 or higher you can use IP restriction etc via conditional access. The mentality is that service accounts should be applications with cert auth.

 

It could get very interesting.

[gsk]

Microsoft seem to be the masters in not being able to communicate clearly. I suspect there may be a push to MFA for all users. However if you have P1 or higher you can use IP restriction etc via conditional access. The mentality is that service accounts should be applications with cert auth.

 

It could get very interesting.

 

And there's the problem. A lot of what MS seem to be doing at the moment is trying to upsell additional subscriptions. User-based MFA works fine for a lot of places and give the granularity to have MFA for staff but not students.

 

Anyone else feel the tide might be about to turn on cloud-first in education?

[psydii]

@RobFuller is correct.

[5tu]

I wonder how Salamander will handle this change?

[psydii]

From the link :

"All users signing in to the Azure portal, CLI, powershell or Terraform to ADMINISTER Azure resources are within scope of this enforcement"

 

"Token-based accounts used for automation are excluded" (which is how Salamander talks to AzureAD as I recall)

 

 

Also, SDS is not an Azure resource (it might be built on Azure, but the service is not part of the Azure offering) so as per the above will be out of scope.