Hello, everyone. In today’s article, we’ll explain the required licensing and the MFA configuration options. We’ll also explain Conditional Access policies and how they help protect access together with MFA. This article covers the “configure multi-factor authentication settings” topic of the AZ-500 – Microsoft Azure Security Technologies exam. If you’re preparing to take this exam, don’t miss the upcoming articles on this blog.
Microsoft Entra Multifactor Authentication License
There are three MFA license editions in Azure, which are:
- MFA for Azure AD Admins – This is the free edition for Azure global administrators until MFA is enabled, at which point everyone is billed for the service.
- MFA for Office 365 – This edition is included in Office 365 user licenses.
- Azure Multi-factor Authentication – This is the most complete MFA edition and is available by default in the P1 and P2 editions, and can also be included in custom subscriptions.
Conditional Access Policy
Conditional Access policies control access to a resource in Azure through requirements defined by the administrator, which may or may not require two-factor authentication, or other identity confirmations according to the requirements met.
Conditional Access policies can be applied to the resources below:
- Azure portal
- Azure Resource Manager provider
- Classic management service APIs
- Azure PowerShell
- Azure Visual Studio portal
- Azure DevOps
- Azure Data Factory portal.
Configuring Two-Factor Authentication Methods
To define which verification categories will be used by users to confirm their identity, access this link and enter your Azure credentials.
Click the Additional cloud-based MFA setttings option.
Applications older than Microsoft Office 2013 don’t use modern authentication and, to skip the second MFA verification, they need this option to be enabled.
Defining Trusted IPs
The Trusted IPs feature in Microsoft Entra multifactor authentication allows users connected on the company intranet or in federated environments to access Azure services without being prompted for two-factor authentication. There are two options to configure:
Skip multi-factor authentication for requests from federated users on my intranet
This option is used in hybrid federated environments with AD FS. The AD FS server sends a verification, and MFA identifies that the users are on an intranet, skipping the need to request a second authentication.
Skip multi-factor authentication for requests from following range of IP address subnets
This option is used when you have trusted networks where two-factor verification isn’t necessary. Only IPv4 network addresses can be included in this exemption model.
Configuring Verification Methods
In the verification options menu, you can define which verification methods explained in this article will be used to validate users’ identity. In the previous article, we gave a brief introduction to each of these methods. If you haven’t read it yet, click this link.
Remember multi-factor authentication
This option lets you define the period during which users will be prompted to perform two-factor authentication using MFA on their devices marked as trusted. When enabled, you can set a re-authentication period of up to 60 days.
When using browsers, users have an option not to authenticate for a number of days, and this is controlled through browser cookies. For applications not accessible through a browser, this is controlled every hour through token refreshes.
Summary
In today’s article, we talked about Microsoft Entra multifactor authentication licensing and Conditional Access policies, and explained the MFA configuration options.
In the next article, we’ll continue with the “Configure Microsoft Azure Active Directory for workloads” topic, explaining how to activate Microsoft Entra multifactor authentication for users in Azure.
I hope this content has contributed to enriching your knowledge of Azure.
Did you like the post? Like and share it. 🙂
If you have any suggestions or comments, leave a comment.
[ ]’s
Ulysses Neves
