Conditional Access - MFA

[Olliedawg]

Morning all - not long now till Christmas break..!

 

We've recently got Entra P1 & I'm having a play around with Conditional Access (all new to me). In mid/late January we are looking to roll out MFA to all staff. Just wondering what the best practices are, how you have gone about it.

 

I've seen some setting their public IP as a safe location & not requiring MFA from there, then enforcing MFA from all other locations but this also blocks the initial registration if users are only logging in from the safe location.

[CHiLL]

I've seen some setting their public IP as a safe location & not requiring MFA from there, then enforcing MFA from all other locations

This is how we have ours configured. Despite encoring MFA as a requirement for non-school IP addresses, we don't force users to enroll MFA straight away. Instead, whenever a user attempts to access Microsoft services from another location, they must complete the MFA sign-up process before they can proceed and once complete, they can access it. That way we aren't bothering people to do it who have no intention of accessing the resources outside of school. If someone has issues, we can troubleshoot it by hotspotting or using a WiFi that we have that bypasses the filtering and firewall.

[Tefters]

Zero trust here for staff, no safe location. Also MFA is enforced from the start.

 

As for students, realistically cannot MFA so restrict access to UK only, all other locations blocked and risky/suspect account logins are immediately flagged on email.

 

I still need to get around to setting up SSPR for staff now they have MFA.

Edited December 17, 2024 by Tefters

[sideone]

Instead, whenever a user attempts to access Microsoft services from another location, they must complete the MFA sign-up process before they can proceed and once complete, they can access it.

 

Doesn't this open you up for phishing, as if someone maliciously tries to access one of these accounts from abroad they'll get a "please set up MFA" message and then be able to access.

[supportman]

We just restrict all access to the UK with a whitelist for staff away on trips. MFA for key personnel manually set.

 

Stopped phishing and hacking accounts overnight once we applied it.

[TechMonkey]

We do have safe locations set for the school sites as a compromise to staff. Setting up MFA must be done on site, to prevent unauthorised setup, and staff are reminded multiple times. I need to find a way to check and force an update on those that set it up a while ago and are not using the new MS number MFA. I'm also seriously considering being a nasty get and seeing if there is a way to enforce MS Authenticator.

 

We also have a general block on any country that hasn't been requested to be allowed. So far we only have very few allowed countries, a few that regular trips go to and we have international students so we can't lock down as much as we would like.

[Olliedawg]

So far the policies i've created for testing with a dummy account are :

 

Block logins from all countries besides UK

 

Require MFA when not on school network (safe network)

 

Seems to work well, however i'd like a way to get staff to register MFA from within the safe location too.

[howartp]

Seems to work well, however i'd like a way to get staff to register MFA from within the safe location too.

Another CA policy to prevent registering from outside the safe location.

 

Users: All

Target resources: User Action - Register Security Info

Network: Any network and all Trusted Locations excluded

Grant: Block

 

If you have any A5 licences (you only need 1) you can also force users to register - that's under "Multifactor Authentication Registration Policy"

[paulkerton]

Just to add, there is no such thing as safely whitelisting an IP address. It is far, far too easy to spoof an IP address - and if I know the school I'll easily get the IP address by checking which IP has vandalised the school web page the most.

Allowing a "safe network" (there is no such thing) will also be a fail of Cyber Essentials from April 2025.

[TechMonkey]

Allowing a "safe network" (there is no such thing) will also be a fail of Cyber Essentials from April 2025.

 

Can you point out where this is documented? I haven't seen any changes regarding this and can't find any having had a quick look.

[Edu-IT]

We do have safe locations set for the school sites as a compromise to staff. Setting up MFA must be done on site, to prevent unauthorised setup, and staff are reminded multiple times. I need to find a way to check and force an update on those that set it up a while ago and are not using the new MS number MFA. I'm also seriously considering being a nasty get and seeing if there is a way to enforce MS Authenticator.

 

We also have a general block on any country that hasn't been requested to be allowed. So far we only have very few allowed countries, a few that regular trips go to and we have international students so we can't lock down as much as we would like.

By MS Number MFA do you mean the one where it pops up with a number to match to what is shown on screen? How do you disable this and what are the disadvantages to using the numbers?

[Roberto]

We used to use IP addresses/ trusted networks for conditional access, but I’d no longer consider that ‘safe’. Not to mention it’s difficult to manage if you have a large number of sites.

 

Right now we trigger conditional access based on device and user state/risk, the ‘zero trust’ model mentioned above. This is both an improvement in security posture and frankly, easier to manage.

[TechMonkey]

By MS Number MFA do you mean the one where it pops up with a number to match to what is shown on screen? How do you disable this and what are the disadvantages to using the numbers?

 

Yes I do. I've found some of our studious staff who setup MFA as soon as we asked them to seem to still having to use the old enter the code from your phone mode or the pop up accept mode. In my view the numbers view is better as it prevents the result of MFA fatigue, of just pressing accept when the pop up appears, or having to actually use something the website gives you.

 

Not sure how to do it at the moment, I'll report back if I find something.

 

As for IP conditional access, as Roberto says, it is part of Zero Trust, but shouldn't be the only check. We are looking at the options like adding Entra Joined as another conditional. So, a member of staff onsite would have to use MFA to access their emails on their personal phone, but not on their work device. We are looking at other options as well. As ever it is weighing up the possibilities and finding the line you are happy to defend and the compromises that get you there.

 

But I've not found anything about Cyber Essentials banning IP based conditional access.

[paulkerton]

Can you point out where this is documented? I haven't seen any changes regarding this and can't find any having had a quick look.

We've been told this by our Cyber Essential assessors. I don't know where it may be in the documentation, but this is what we've been advised.

[robintech]

Just to add, there is no such thing as safely whitelisting an IP address. It is far, far too easy to spoof an IP address - and if I know the school I'll easily get the IP address by checking which IP has vandalised the school web page the most.

Allowing a "safe network" (there is no such thing) will also be a fail of Cyber Essentials from April 2025.

 

I can see its a weakness as any device on that network bypasses MFA if that's all we have but what methods are there to spoof a public IP address?

[StephenPink]

We've been told this by our Cyber Essential assessors. I don't know where it may be in the documentation, but this is what we've been advised.

 

As far as I'm aware/can tell, it's not explicitly stated, however it does state the below regarding MFA:

 

There are four types of additional factor to consider:

- a managed/enterprise device

- an app on a trusted device

- a physically separate token

- a known or trusted account

 

So I read that as, a "trusted network" or the like, is not considered an additional factor.

[HPlum78]

You may have seen that MFA spoofing/ phishing is becoming a much bigger thing so have included the MS link below as something that should be done in this space to protect highly privileged accounts, along with some links to the details of how and what is being used:

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/rockstar-2fa-a-driving-force-in-phishing-as-a-service-paas/

https://www.beyondidentity.com/resource/how-to-defend-against-rockstar-2fa-bypass-attacks-targeting-microsoft-and-google

https://news.sophos.com/en-us/2024/12/19/phishing-platform-rockstar-2fa-trips-and-flowerstorm-picks-up-the-pieces/

 

https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-admin-phish-resistant-mfa