\n
\n
<\/h2>\nPasswordless Based Authentication<\/h2>\n
Passwordless authentication methods are more convenient because the password is removed and replaced with something you have, plus something you are or something you know.<\/p>\n
Azure and Azure Government offer the following three Passwordless authentication options:<\/p>\n
- \n
- Windows Hello for Business:<\/span>
\n– ideal for users with their own designated computer
\n– biometric and pin credentials are tied to users pc
\n– with Public Key Infrastructure (PKI) integration and built in SSO support, it provides convenient access for cloud services<\/span><\/li>\n<\/ol>\n- \n
- Microsoft Authenticator app
\n– <\/span>allow your employees phone to become a Passwordless authentication method<\/span><\/li>\n- Fast Identity Online (FIDO2) security keys
\n– <\/span>This is an open standard for Passwordless authentication
\n– this is a hardware device that handles authentication
\n– Users use an external security usb key to authenticate.<\/span><\/li>\n<\/ol>\n\n
<\/p>\n
\n
\n
\n
<\/h1>\n
Implementing an Authentication Solution based on Windows Hello for Business<\/h1>\n
\n
\n
Using InTune<\/span><\/p>\n
- \n
- Go to endpoint.microsoft.com (InTune) -> Devices -> Enrol Devices -> Windows Hello for Business<\/span><\/li>\n
- The options here are:
\n– enable Windows Hello for Business
\n– set PIN options (max length, special characters etc\u2026)
\n– Use TPM (required or preferred)
\n– allow biometrics
\n– Enable enhanced anti-spoofing
\n– Allow security keys (FIDO2)<\/span><\/li>\n<\/ol>\n\n
Devices must first be joined to Azure AD<\/span><\/p>\n
\n
<\/p>\n
Within Windows 10<\/p>\n
- \n
- Go to Accounts -> Sign in options<\/span><\/li>\n
- Here you can set up PIN and biometrics<\/span><\/li>\n<\/ul>\n
\n
<\/h1>\n
Enabling the FIDO2 based Security Method in Azure AD<\/h1>\n
\n
- \n
- Go to Azure AD -> Security -> Authentication Methods<\/span><\/li>\n
- Click on FIDO2<\/span><\/li>\n
- Click on Enable<\/span><\/li>\n
- specify which users you want to be able to use this option<\/span><\/li>\n
- Click on Configure for more options:
\n– allow self-service set up
\n– enforce attestation (only approved keys will work)
\n– Restrict certain keys (you need the AAGUID for the key you want to restrict)<\/span><\/li>\n<\/ol>\n\n
\n
<\/h1>\n
Password protection within Azure AD, and Smart Lockout On-Premise ADDS<\/h1>\n
\n
Password Settings\/Policies for cloud only users<\/h2>\n
In M365 Portal<\/p>\n
- \n
- Go to M365 Admi portal -> Settings ->Org settings -> security and privacy<\/span><\/li>\n
- Click on ‘Password expiration policy’<\/span><\/li>\n
- Here you can turn on password expiration (its off by default) and when to expire them (default is 90 days). You can set how many days to notify a user before it expires<\/span><\/li>\n<\/ul>\n
\n
<\/p>\n
In Azure Portal:<\/p>\n
- \n
- Go to Azure AD -> Security -> Authentication methods -> Password protection<\/span><\/li>\n
- Here you can set the following settings:
\n– Lockout threshold: how many times they can incorrectly enter a password before getting locked out
\n– lockout duration in seconds
\n– Banned passwords list: enter a list of passwords that are banned
\n– Enable password protection on windows Server Active Directory_
\n– Mode: Enforced (its on for people), Audit (its just logging)<\/span><\/li>\n<\/ul>\n\n
<\/h2>\n
Password Settings\/Policies for on premise AD<\/h2>\n
- \n
- Open Group Policy Management<\/span><\/li>\n
- These settings are in: Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account Policies -> Password Policy<\/span><\/li>\n
- Settings here include:
\n– password history (don\u2019t allow users reuse passwords)
\n– Max password age (when password needs to be changed in days)
\n– Min password age (how long users must keep a password before they can change it)
\n– Password length (in characters)
\n– Complexity requirements (include numbers, uppercase, symbol etc\u2026)<\/span><\/li>\n- Account Lockout policy: lets you set the threshold, duration etc\u2026<\/span><\/li>\n<\/ul>\n
\n
\n
<\/h1>\n
Configuring and Deploying Self Service Password Reset(SSPR)<\/h1>\n
\n
Note: Administrators can use this but only with MFA<\/p>\n
\n
<\/p>\n
Hybrid Environment<\/span><\/p>\n
If running Hybrid environment you must have password writeback enabled in Azure AD connect to be able to change passwords in Azure.<\/p>\n
You must have premium Azure licences to enable SSPR with writeback to on premise AD.<\/p>\n
\n
<\/p>\n
Configuring SSPR<\/span><\/p>\n
- \n
- Go to Azure AD ->Users ->Password Reset<\/span><\/li>\n
- From here you can enable SSPR<\/span><\/li>\n
- Select which users or groups to apply it to<\/span><\/li>\n
- Number of methods required to meet: you can select the number of ways a person must be able to prove themselves (email, phone, security questions, authenticator app etc\u2026)<\/span><\/li>\n
- Security questions: you can select how many questions a user needs to answer and which questions they are. You can add custom questions<\/span><\/li>\n<\/ol>\n
\n
<\/h1>\n
Implementing and Managing Tenant Restrictions<\/h1>\n
This is a way of restricting users from logging in to other Organisations M365 tenants when on your network. You need a proxy device to enforce this.<\/p>\n
\n
<\/p>\n
\n
<\/p>\n
How it works<\/span><\/p>\n
The overall solution comprises the following components:<\/span><\/p>\n
- \n
- Azure AD: If the\u00a0<\/span>Restrict-Access-To-Tenants: <permitted tenant list><\/span>\u00a0header is present, Azure AD only issues security tokens for the permitted tenants.<\/span><\/li>\n
- On-premises proxy server infrastructure: This infrastructure is a proxy device capable of Transport Layer Security (TLS) inspection. You must configure the proxy to insert the header containing the list of permitted tenants into traffic destined for Azure AD.<\/span><\/li>\n
- Client software: To support tenant restrictions, client software must request tokens directly from Azure AD, so that the proxy infrastructure can intercept traffic. Browser-based Microsoft 365 applications currently support tenant restrictions, as do Office clients that use modern authentication (like OAuth 2.0).<\/span><\/li>\n
- Modern Authentication: Cloud services must use modern authentication to use tenant restrictions and block access to all non-permitted tenants. You must configure Microsoft 365 cloud services to use modern authentication protocols by default. For the latest information on Microsoft 365 support for modern authentication, read\u00a0<\/span>Updated Office 365 modern authentication<\/span><\/a>.<\/span><\/li>\n<\/ol>\n
\n
- On-premises proxy server infrastructure: This infrastructure is a proxy device capable of Transport Layer Security (TLS) inspection. You must configure the proxy to insert the header containing the list of permitted tenants into traffic destined for Azure AD.<\/span><\/li>\n
- From here you can enable SSPR<\/span><\/li>\n
- These settings are in: Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account Policies -> Password Policy<\/span><\/li>\n
- Here you can set the following settings:
- Click on ‘Password expiration policy’<\/span><\/li>\n
- Click on FIDO2<\/span><\/li>\n
- Here you can set up PIN and biometrics<\/span><\/li>\n<\/ul>\n
- The options here are:
- Fast Identity Online (FIDO2) security keys
- Microsoft Authenticator app