Multi-Factor Authentication Basics
Multi-Factor Authentication (MFA) adds a second verification step to sign-in, reducing the risk of stolen credentials. When a user provides their password, MFA requires a second factor—something they have (like a phone) or something they are (like a fingerprint). This extra layer makes it much harder for an attacker to gain access even if they steal a password.
Configuring Authentication Factors
Admins choose the authentication methods that best fit their users and risk profile. The available options include the authenticator app, which sends push notifications or time-based codes; SMS one-time passcodes, which send a code via text message; and FIDO2 security keys, which are hardware tokens that use public-key cryptography. Each method has tradeoffs in convenience and security. For example, SMS is widely available but can be intercepted, while FIDO2 keys are more secure but require physical devices. Admins can also configure smart lockout thresholds and lockout durations to protect against brute-force attacks while minimizing impact on legitimate users.
Embedding MFA into Conditional Access Policies
Conditional Access in Azure AD uses signals like user role, location, and risk level to enforce access policies. Integrating MFA into Conditional Access ensures that only trusted users and devices can access Azure resources, even if their passwords are compromised. To embed MFA, an admin defines a policy with three parts. Under Assignments, include all users or specific roles and exclude break-glass accounts that need emergency access. Under Conditions, set Sign-in risk or User risk to trigger the policy on Medium or High risk levels. Under Access controls, select Grant and then Require multi-factor authentication. Under Session, configure Sign-in frequency to enforce reauthentication after a specified time period.
