I recently switched from Security Defaults to Conditional Access.

Question

I recently switched from Security Defaults to Conditional Access.

Kinkzter 1

All of my users were using the Microsoft Authenticator App. I included all users, excluding myself. I included all Cloud apps. Under Grant, I selected "Require MFA", and Require one of the selected controls. I created a special policy for myself that was nearly identical for Admins, and my Microsoft Authenticator App was fine. All of my users are broken. I have to require re-register mfa on each user and set them back up.

2 answers

Your answer

Answer 1

Hello @Kinkzter

Thank you for your post.

I would like to get familiar with your concern a little bit more if it is ok... From what I understood was that you were using security default but when swapping to Conditional access, you were noticing that all of your users were broken.

Could you please elaborate more this statement "All of my users were broken" ?
What were the modifications/conditions made at the moment of doing this ?
Do you configure any custom action conditions for risky-users or groups?

I just wanted to do a friendly reminder when using security defaults as shown below:

https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults

Finally, you may think of using this feature as an option as shown on the next picture.

I hope this was useful for you to get a better picture of this : )

Cheers,

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Kinkzter 1

Thank you so much for your response!

I created four policies to try and match Security Defaults. A policy for Admins, which includes myself, and also includes all of the administrator roles above in your picture. I created a role to block Legacy Authentication as I already had this in place with Security Defaults. I created a policy for Azure Management. My last policy was specifically for users. Inside the End User Protection policy that I created, I included all users except for my ADSync and management accounts used for relay, such as copy machine scanners, I included All Cloud Apps, I included under Grant Access to Require MFA and selected Require one of the selected controls. I set a session for 90 days before needing to authenticate using Sign in frequency.

Could you please elaborate more this statement "All of my users were broken" ? With each individual user I am having to go into Azure under User, Authentication Methods, and "Require re-register Multifactor Authentication", because the Microsoft Authenticator won't allow them to use the business account previously created under Security Defaults to authenticate. It doesn't prompt them or give them a One-time passcode. It's broken for all users.
What were the modifications/conditions made at the moment of doing this ? I switched from Security Defaults to the policy I mentioned above for End User Protection.
Do you configure any custom action conditions for risky-users or groups? No sir.

risolis 8,741 Reputation points

2022-07-24T20:52:18.63+00:00

Hello @Kinkzter

You're welcome.

I wonder if you review this specific setting shown below:

Just a friendly reminder, You might be using the security default feature when you are using a Free Azure AD license but when you have the P1/P2 Azure AD license, you shall use the Conditional access policy.

Cheers,

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
risolis 8,741 Reputation points

2022-07-25T00:51:19.26+00:00

I saw your comment from an email notification but not reflected here yet.

So try to do it from here...

https://account.activedirectory.windowsazure.com/usermanagement/mfasettings.aspx

Cheers,

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Kinkzter 1 Reputation point

2022-07-25T10:56:57.183+00:00

Does this override the settings in Conditional Access, or is this in addition to the settings in Conditional Access?
risolis 8,741 Reputation points

2022-07-25T13:10:42.563+00:00

Thanks for your response.

Just to give you more details for it, please direct yourself to the following info/link below:

A common Conditional Access policy is to add trusted locations as an exception to multi-factor authorization requirements. The logic goes, if you accessing resources such as Office 365 from a location such as the corporate office, that’s an element of verification in itself that your login should be trusted, so we should improve your user experience by removing MFA. Personally, I support the use of MFA regardless of where you are authenticating (at the very least, if you have an Azure AD admin role assigned). However, doing something like this is a great option if you are introducing MFA from scratch: you will improve user buy in the less you change their standard experience. Then, increase the scope gradually.

https://campbell.scot/conditional-access-skip-mfa-for-company-devices-on-the-company-network/

I hope that can help on this case scenario stated by you before : )

Cheers,

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
risolis 8,741 Reputation points

2022-07-25T22:46:27.767+00:00

Hello @Kinkzter

I hope you are great.

I wonder if you were able to read previous post and if that was the accurate response for your last question.

Regards.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
risolis 8,741 Reputation points

2022-07-27T02:58:41.023+00:00

Hello @Kinkzter

I hope you are having a good day.

I would like to know if further assistance is needed...

Cheers!

Share via

I recently switched from Security Defaults to Conditional Access.

2 answers

Your answer