Chapter 7: Planning and Implementing Azure Multi-Factor Authentication (MFA) and Self-Service Password Reset (SSPR)

The previous chapter covered the various ways to implement hybrid identity synchronization between Azure Active Directory and Windows Active Directory, and how to implement seamless single sign-on. In this chapter, we will discuss the planning and implementation of Azure MFA and SSPR for users and groups. This will include deploying, managing, and configuring MFA for users and groups. This chapter will also cover the differences between verifying identity with MFA and SSPR.

In this chapter, we're going to cover the following main topics: 

• Planning Azure MFA deployment (excluding MFA Server)
• Implementing and managing Azure MFA settings
• Configuring and deploying SSPR
• Deploying and managing password protection
• Planning and implementing security defaults

Technical requirements

In this chapter, we will continue to explore configuring a tenant for the use of Microsoft 365 and Azure. There will be exercises that will require access to Azure Active Directory. If you have not yet created the trial licenses for Microsoft 365, please follow the directions provided within Chapter 1, Preparing for Your Microsoft Exam.

Planning an Azure MFA deployment

As more companies move to cloud technologies and having identities within the cloud, the ability to protect those identities become paramount to avoiding security breaches. Microsoft and Azure Active Directory provide many ways to protect these identities and mitigate risks. Some examples of these solutions include the following:

• Password complexity rules are used to protect against users utilizing common terms and easy-to-guess passwords. Enforcing certain lengths and complexities, such as the use of alphanumeric and special characters, along with a minimum length, can deter attackers from their ability to utilize password dictionary attacks or identify dates and information from social media accounts that could be used as a password.
• Password expiration rules are utilized to avoid a password remaining the same for an extended period of time. The longer that a password is used by a user, the more likely that it is to eventually be exposed...

Implementing and managing MFA settings

When we were planning for Azure AD MFA and the authentication methods that are used, we showed the MFA service settings within the Azure AD MFA portal as the location that you use to define the allowed MFA authentication methods for the second factor. In addition to the authentication methods, MFA service settings have other configuration options to customize the use of MFA within the company. The MFA service settings become the company-wide settings for Azure AD MFA that pertain to all users that are enrolled in Azure AD MFA.

In this section, we will look at each of these settings in detail and how they can be used for the Azure AD MFA enforcement within your company:

1. To access the MFA service settings, access Azure AD > All users > Per-user MFA, as shown in Figure 7.19:

Figure 7.19 – Access per-user MFA

2. This will take you to the Azure AD MFA portal site. From this site, select service...

Configuring and deploying SSPR

SSPR is helpful to both the user and to administrators. SSPR saves time because passwords can be reset without a phone call to a support team. There is the convenience of a user being able to change their password when they forget it. It also helps from a security perspective if a user believes that their password has been compromised.

With this convenience, there is also a level of risk. With SSPR enabled, this allows someone who has obtained user credentials to potentially change a user password and lock them out of their account. Therefore, it is important that the configuration and deployment of SSPR protects against this taking place. This section is going to go through the steps and best practices for configuring SSPR.

To access the configuration for SSPR, navigate to Azure AD > Users. Within the Users tile, select Password reset, as shown in Figure 7.25:

Figure 7.25 – Password reset

The next steps will...

Deploying and managing password protection

Azure AD Password Protection is used to configure certain parameters to avoid brute force or dictionary attacks on user identities. These attacks are accomplished by an attacker sending multiple requests with a username and multiple passwords to attempt to find the password being used and gain access. Setting up a threshold of how many attempts can be made before lockout and then the lockout duration will stop these attacks. In addition, administrators can identify passwords that are not allowed to be used within the Azure AD tenant. Microsoft also has a list of passwords that they may also block when attempting to use as a password to protect again dictionary attacks.

Once Azure AD Password Protection is configured, it can be set to enforce across the company or simply to audit initially to gauge the effectiveness. Figure 7.28 shows the Azure AD Password protection tile and the fields that can be configured. This can be accessed in the...

Planning and implementing security defaults

Microsoft provides security defaults within Azure Active Directory to assist companies that are new to Azure AD and Microsoft's cloud in protecting identities. In new tenants, security defaults are already turned on and in place, so there isn't any planning and implementation required. However, there are situations where security defaults will need to be turned off as more advanced identity protection solutions are enabled, such as Conditional Access policies. To access security defaults, navigate to Azure AD, scroll down under Manage in the left menu to Properties, and then scroll down in the Properties tile to Manage Security defaults, as shown in Figure 7.29:

Figure 7.29 – Manage security defaults

Security defaults provide basic identity security settings to the entire tenant and are very helpful in protecting a company. These settings include the following:

• Requiring all users to register...

Summary

In this chapter, we described how we can protect the identities of our users using Azure AD MFA, how to configure Azure AD MFA, and the settings to provide flexibility to how Azure AD MFA is utilized. We discussed the implementation of SSPR for user and administrator flexibility. We discussed password protection and security defaults for additional protection for identities within the Azure AD tenant.

In the next chapter, we will take identity protection and authentication a step further through the use of passwordless authentication.