End users setting up MFA for the first time. Experience and security?

[Jason_Benway]

We are working on a plan to force MFA for none trusted IPs. But most of our users have not setup MFA yet. I'm concerned the setup process isn't simple enough and thinking about risk. How do you allow users to setup MFA securely. 

I mean if they don't have MFA setup yet, how do you verify its them setting up MFA? All they would need to setup MFA is the username/password. 

jb

[#2]

There are a few ways to manage this:

- Some just use user communication and request the users to setup MFA preemptively
- Others use Identity Protection, there is a policy to require MFA setup.
- Some use scripts to check which users haven't set-up MFA (https://techcommunity.microsoft.com/t5/azure-active-directory/report-on-users-with-mfa-enabled/m-p/1...)

[#3]

Sorry I wasn't clear.

Our concern it when I user is going to setup MFA for the first time, if they do it themselves. How do you know its them setting it up?

That seems like a risk. Your enabling MFA to reduce risk and add security but you only have username/password when your first setting up MFA to confirm its them.

it would be better if I could use CA when setting the user sets up MFA to require the user to be on a trusted network or on a managed device.

[#4]

We can already do this: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-registration-mfa-sspr-c...

[#5]

This is also usually how we set it up, only allow MFA Registration from our own IPs or at least the countries we are active in.

[#6]

Hi Jason,

1. Simplicity: Microsoft has released some cool MFA enhancements to make it easy for the user to adopt it without IT help. Please go ahead and try it.


https://techcommunity.microsoft.com/t5/azure-active-directory-identity/cool-enhancements-to-the-azur...

2. Risk: Enable Users risky reports, which will notify you if anyone logged from unfamiliar IP address, it works very well.

Thank you and hope it helps!
Moe

[#7]

Hi @Jason_Benway,

As has been mentioned a couple of times above, you can secure the MFA registration process using Conditional Access policies - I wrote about this a while ago (when it entered preview) if you wanted some more context / background. See here: Security Information Registration & Conditional Access.

In short, CA allows you to determine the conditions under which Security Information can be registered, trusted location, compliant device, specific restrictions for high profile users etc. It's a highly flexible way of controlling registration.

Good luck! 🙂

Kelvin