More and more organizations are using Multi-Factor Authentication (MFA) to protect their access and self-service password reset (SSPR) to reduce support costs and empower their users to manage their credential recovery. Our internal studies show that customers can cut their risk of account compromise by 99% by enabling MFA, so we’re REALLY happy to see this growing trend.
With this increasing usage, we also heard loud and clear that you want to control the conditions in which security sensitive MFA or SSPR information can be registered. This helps ensure it’s the right user—not an attacker—registering this security sensitive info.
Some common restrictions you requested include ensuring that:
Users are on a trusted network.
Only users with a low sign-in risk can register security information.
Users can only register on a managed device.
First, create a policy to block registration for users that are not on the corporate network, but are still allowed to manage credentials from anywhere, as long as they can use MFA.
Next, make sure that all users you want to apply this policy to are part of the MFA and SSPR preview. This is required because users not on the preview will use the older security information page and the policy will not be enforced.
Steps for setting up policy
Include the users the policy will apply to using the Users and groups.
Apply policy to the Register security information action, which is now included in the Cloud apps oractions.
Set the Locations. Include Any location; exclude all trusted networks.
Set the access grant control to require multi-factor authentication.
Enable policy and Save.
Now, if a user is outside of a trusted network and attempts to register MFA for the first time, they’re blocked and shown the following message:
As soon as they register MFA, they’ll be able to manage MFA and SSPR registration details from anywhere.