5 May 2023 • 3 min read • Public

Azure Authentication Methods Policy: What is it and what does it change?

If you've been looking around in the Azure portal, you may have seen a newer blade in the menu named Authentication Methods

Photo by Growtika / Unsplash

If you've been looking around in the Azure portal, you may have seen a newer blade in the menu named 'Authentication Methods' under the Azure Active Directory Security hub. The Authentication Methods Policy is a newer feature in Azure that is optional now, but will become mandatory before you know it.

The Authentication Methods Policy is the first big push that Microsoft is doing towards deprecating the legacy cloud MFA method, Per-User MFA. Per-User MFA has been around as a default option to enforce and configure MFA on free Azure subscriptions for years, before many companies had even considered migrating their operations to the cloud. Over that time period, alternative methods for MFA like Conditional Access Policies and Security Defaults have come in and seen great usage, with Security Defaults now being enabled by default on all newly provisioned Azure tenants.

It's an open secret that Per-User MFA has been somewhat of a thorn in the side of Azure security for some time. The user interface for Per-User MFA exists outside of the normal Azure and M365 portals. Script management of Per-User MFA can only be done in PowerShell through the MSOnline module (which is being deprecated itself), and Per-User MFA has never been exposed through APIs like MS Graph or MS Defender that Microsoft is clearly putting a lot of resources into developing.

Per-User MFA can be thought of as having 2 key functions: user enforcement of MFA and approved MFA methods. The Authentication Methods Policy has been developed to replace the Per-User approved methods, so half of Per-User MFA. At time of writing, Microsoft has not announced plans to deprecate the enforcement capabilities of Per-User MFA.

With the Authentication Methods Policy comes an upgrade to the capabilities in the form of System-Preferred MFA, where the organization can encourage users towards stronger MFA methods. Organizations are also able to define Authentication Strength lists of different MFA methods. These Authentication Strengths can then be used as another control in your Conditional Access Policies to require strong MFA methods for access to sensitive data and applications.

If you go to the Authentication Methods Policy page in Azure or M365, you will also see a notice that legacy MFA policies are being deprecated in September 2024, along with links to Microsoft documentation migration guides. These will tell you how both the Per-User MFA and Authentication Methods Policy will be respected during migration process.

The takeaway here is that Per-User MFA is slowly but surely being replaced in Azure by newer modern MFA administration tools. Microsoft have made the smart choice to give all customers a long runway until these new controls are in place, especially for larger organizations that need that runway to migrate smoothly. Change is coming, and Azure will be able to be more secure and better managed because of it.

Sources:
https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-methods-manage

https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-strengths

https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/azure-ad-change-management-simplified/ba-p/2967456

You might also like!

Senserva and Microsoft announced we are a Security ISV of the Year and Endpoint Management Trailblazer finalist in the Microsoft Security Excellence Awards!

Senserva builds with the Microsoft security products and Microsoft focused security services providers to provide customers a unified solution.

Azure Active Directory 17 Mar 2024 3 min read Public

New Senserva Web Site is On Line

Senserva has a great new web site, its full of details around what we help secure and how we work with high end security partners to provide a full solution.

Azure Active Directory 11 Mar 2024 1 min read Public

Senserva and Bulletproof Solutions Announce Partnership to Develop A Safer Environment for Microsoft Customers

Senserva and Bulletproof Solutions have announced a strategic partnership to develop and deliver industry-leading software solutions to secure customers' Microsoft Entra, Sentinel, and Defender workloads. We look forward to continuing to innovate together to create cutting edge solutions. Please see the below press release from Bulletproof: https://bulletproofsi.com/

Microsoft Security 27 Feb 2024 2 min read Public

If you just need a Database for Storage, you must use Entity Framework

When you are a developer, you fundamentally spend your time working with data. Getting data, changing data, sending data. At some point though, you will need to save the data somewhere. This is where databases come in, storing the data for later to be used or for other programs and

Senserva 28 Jul 2023 2 min read Public

Azure AD Role Scoring

At the time of writing this post, Azure AD contains 91 built-in administrative roles. These roles have varying degrees of power within Azure AD. The team at Senserva has built a scoring system for grading these roles so that our analytics platform can grade each user's power level

Azure Active Directory 10 Jul 2023 8 min read Public

Azure AD Roles: Global Admin Assignment should be a Last Resort

Azure Active Directory has many components to it, with many features and capabilities. These different possibilities necessitate the creation of a Role system in Active Directory, to define any users responsibilities. As of writing there are 91 built-in Azure Active Directory roles that can be assigned. This many options and

Senserva 8 Jun 2023 2 min read Public

Azure AD Conditional Access Best Practices

Today we'll be taking a look at Azure AD Conditional Access. Conditional Access is a feature of Azure AD Premium P1 and P2 that helps organizations control how users access corporate resources

Conditional Access 11 Apr 2023 11 min read Public

In-depth Senserva Insights from CEO Mark Shavlik

The Senserva team and I spent a good amount of time creating the content for this video as we often get asked "What does Senserva do?". Senserva is integrated with Microsoft security products, including Microsoft Sentinel, Defenders, Intune, Azure Active Directory and others.

Azure Active Directory 23 Feb 2023 1 min read Public