Microsoft 356 MFA Issue

[SimonB]

Anyone had issues with users within 365 not being prompted for MFA when they sign into a new device etc. For example, 5 new user accounts had been setup over the next month and MFA was setup using the Auth App. I have tested logging in using their account and password on a new device and IP not used before and after entering the password I could simple go to their outlook via office.com WITHOUT doing MFA.. Massive security risk. Security defaults are enabled and older user accounts do not seem to be effected (I get prompted for MFA)

Any one know why?

 

[Sky-Knight]

Someone... is using Security Defaults.

Providing a default level of security in Microsoft Entra ID - Microsoft Entra

Get protected from common identity threats using Microsoft Entra security defaults.

learn.microsoft.com

Security Defaults will make a user enroll in MFA, but will not actually use it unless the platform detects risk. If you want to change this behavior you must deploy Conditional Access, which requires Entra ID P1. Which is included in M365 Business Premium.

m365maps.com can help sort out where the individual entitlements live.

But TLDR, it's working as designed and configured.

Note, anyone that talks to you about using the single user O365 MFA needs slapped, that feature is deprecated and leaving the platform. It's best to not rely on it. However, if you want to turn that back on and go back to ticking boxes it IS possible.

Azure admin portal -> Entra ID Authentication Methods, click the manage migration button, set it to "In Progress"

Again I don't recommend this everyone should be using Conditional Access AND the migration should be COMPLETE. So the AZURE tools do the configuration. This puts all your MFA enforcement in Entra ID Conditional Access, and your MFA methods in well.. Authentication Methods. TWO SCREENS to control it all, at a glance. It's MUCH easier.

 

[YeOldeStonecat]

Answered in your post this morning in the other thread...

New clients MFA is all out of whack and not sure how to fix it.

Yeah the problem is Security Defaults does NOT enforce MFA on all users. It only enforces MFA on ADMINS. It uses MFA on users only at specific times, like accessing the security section of the account. It's not great... BUT from what I've seen if the user takes the time to do phone signon...

www.technibble.com

 

[SimonB]

Thanks for the info. Getting our customers to change from a standard or basic 365 license to Premium will likely never happen.


The thing I struggle getting my head round is this. For example, A tenant has say 20 users all with MFA setup. 15 have been there for 2 or more years and 5 are newer users in the last couple of months.

If i was to login to each of the 15 user accounts from any device not been used before they will all be asked for MFA.. The 5 other users wouldn't be asked at all. We have tested this numerous times. How can old accounts be any different?

 

[YeOldeStonecat]

So I'm wondering if your clients 365 tenant...actually doesn't have "security defaults enabled"....it's just running on the old "manually toggle MFA per user" in the 365 admin portal.

Most tenants should have been migrated to at least security defaults..automatically, when Microsoft rolled out that change (almost 2 years ago)..but, as I've seen, some old tenants don't always pick up those changes. So..if it's still on the old manual MFA...maybe the old user accounts had that turned on by someone...back then. And..adding new accounts..it's not turned on.

Yes...its can be an uphill battle getting clients to realize the level of importance of having proper security measures in place. I basically tell them now....."I'm not going to support lower than M365BizPrem...I don't want the crazy high risk of managing your business stuff and having it not secured well!" And..spell out all of the other advantages of BizPrem...that save them money over time because you can set up automation of stuff to make things quicker and easier for you.

And I'm recently on the warpath to raise it yet another level...Entra P1 is not enough, time for Entra P2.

 

[SimonB]

Yeah the tenants all have security defaults enabled. Strange one. I would love to tell them we wont support their 365 if they do not upgrade their licenses but they only care about the money and they might well take their business elsewhere. (Not matter how great we are at everything lol)

 

[britechguy]

I would love to tell them we wont support their 365 if they do not upgrade their licenses but they only care about the money and they might well take their business elsewhere. (Not matter how great we are at everything lol)

And to stay in business you very often have to "care about the money" as a condition of doing so, especially for very small to micro businesses.

One size does not fit all, for anything, and that definitely includes security requirements, too. Back to my favorite quotation in that regard:

In the computer security field, we often say that one doesn't need Fort Knox to safeguard a broken bicycle.
~ Glenn Glazer, M.S. ’07 UCLA Security & Cryptography,
April 25, 2019, in Message on Groups.io Beta Group

My little client with 3 employees that runs a local business does not have the same security requirements as a multi-billion-dollar multinational does. It would be insane of me, and bad practice, to try to convince them that they do.

What comes with M365 Business Standard is more than secure enough to keep their fully functional bicycle quite safe, thanks.

 

[YeOldeStonecat]

I know we'll always disagree on this...and I say this in a friendly way.
M365BP is really just..."the middle". Far from "Fort Knox"....
$26.60 per user per month on month to month plan, $22 if annual commit (even pay monthly..with annual commit)

Let's look at ...what Fort Knox is.
You start with an M365 E5 license...$68.40 on month to month, I think $54.something if annual commit.
E5 brings in extended identity and threat protection, with automated security. And a lot of other compliance controls.
And...you don't even get Teams with it, that's an extra.
And...if you want to properly be Fort Knox, you'll still bolt on an external automatic remediation service like BlackPoint at the endpoint, to monitor Defender even better, stack on another 8 bucks per user.
So you're over $70 bucks per person per month. But I'll drop the add on, and go annual commit with just an E5 license at $54. That's still over double what a M365BP m/m license is.

So currently...I just "left of center"...and when I finish adding EntraP2...I'll "roughly" be center. "Middle of the Road" if you will. Not extreme to the right. And I don't want (my clients) to be on the bottom of the slide rule for protection....not when I'm their MSP and problems fall in my lap.

But I'll add that I have a lot of non profit clients. And many of them don't know...they can get Microsoft donations/charity licenses....so they go with basic. Or...are unfortunately sold basic licenses...maybe standard. M365 Business Premium donation for non profits...licenses 1-10 are FREE. Beyond that, M365 Business Premium for non profit charity...$6.60 per user per month. Add on Entra P2...$3.60.

Yesterday and today I'm taking over management of a 365 tenant for a foundation, and their parent management company. The foundation branch had purchased O365E3 and Defender licensing at full cost...over 28 users. Scaling that down to the freebie 10 and 18 at $6.60 is saving them some cabbage each month!!! And they're getting more than they had before!

To me, at least "have the conversation with the client". Arm yourself with all the facts...not just a mundane sentence or two. Put on your consulting had and...consult! People won't buy what they don't know about! A lot of times you'll find yourself surprised...and they'll go for it without pushback. Yes sometimes they should be reminded that their business information is important...and should be protected. It's a shame to not at least try!

I remember a long time ago, I used to just "quote" what I thought the client wanted. I was afraid to quote the big fancy models. After a client bought a few basic computers from me, he saw a fancy one somewhere...and asked me..."why can't you get those?" I said "I can!" He followed up with "Well why didn't you show me THAT?" I had no answer..other than..I made an ASSumption.

To take the "analogy" that Brian quoted above...I would rephrase it my style...saying..."I'll take that broken bicycle..and I'll FiX IT....straighten the wheels, put on new tires, new brakes, a quality chain, I'll lube the chain, derailer, and gears, ensure the pedals are smooth.....put on a new comfy seat..and sent the rider off having fun...with a helmet on..FOR SAFETY!"

 

[britechguy]

@YeOldeStonecat

I have never taken anything you've said in an "unfriendly manner" and your last message is no exception, even though we disagree.

I say the following with no malicious intent, but you presumed I did not have the sort of conversation you envision, and I did have at least some of it.

The data being protected, in this case, has been perfectly well served by good, old-fashioned, password and MFA level security. If I look in the tenant for "suspicious activity" there has been virtually none since the original transition from on-prem Windows Server to M365/Teams/OneDrive/SharePoint.

I have often made clients aware of "higher level" options, explaining what they offer, but also asking whether these features are something they really feel they need (when I doubt they do). If they decide to go for "the gold plated" version, fine, they have made an informed decision, and one where I have been as clear about everything as I can be.

But unless I think someone is doing something not in their own best interests for a given case, I won't try to upsell if they decline something after all options are on the table.

I'll also gladly upsell any time I have one of the situations where a client asks, "Can I get . . .," and they can, indeed get it if they want it.

Of course, and I openly admit it, I am less risk averse than you are, and am on a completely different planet when it comes to the distance between our willingness to tolerate risk when it comes to @Sky-Knight.

I will continue doing "feature matching" until the day I decide not to do this anymore, and that means that some people will have M365 Business Basic.

I do wish Microsoft had (and would) make more noise about what non-profits can get as far as M365 goes. That's how I got one of my clients on to M365, because doing so as a non-profit made the most sense from a ton of angles, including financial ones.

 

[SimonB]

The USA looked to be very different in what users/companies will pay for these subscriptions. Its a total struggle to get anyone to take a business prem license. 90% of our 500+ customers are on standard. I dont think the best sales person in the world could change that.

 

[britechguy]

90% of our 500+ customers are on standard.

This sounds very much like the residential market in the USA, which has taken years to even kinda-sorta warm to the M365 subscription model.

It does not surprise me that there exist regional attitudinal differences regarding what Microsoft 365 Business service level they'll buy. Just curious if most of your clients are micro-businesses (as in 10 or fewer people per site)?

 

[SimonB]

This sounds very much like the residential market in the USA, which has taken years to even kinda-sorta warm to the M365 subscription model.

It does not surprise me that there exist regional attitudinal differences regarding what Microsoft 365 Business service level they'll buy. Just curious if most of your clients are micro-businesses (as in 10 or fewer people per site)?

Yeah our tenant user count would range from 10 - 100 tops. We have yet to go into the bigger businesses.

 

[britechguy]

Yeah our tenant user count would range from 10 - 100 tops.

Which gives you a situation where, "We don't want to pay for what we don't use," reigns. And I can't blame them.

There is just a huge difference between what micro-businesses want and will (and, often, can) pay for versus what big business will go for. The needs are just very different. Generally speaking, the smaller the business the more limited and basic the needs.