Require MFA for AAD Hybrid joined devices

Question

We are planning a rollout of 2000 new Windows 10 devices to the entire organization on a new domain as part of a merger and accompanying org name change.

We have an onprem environment with DCs that aad sync and federate via ADFS to Office 365 and we have enabled MFA for access to Office 365 outside the company’s network using conditional access.

Currently we are evaluating hybrid joining devices to AAD as well, to achieve sso from within the company’s network, but we want to make sure that MFA is still required from the outside, even on managed devices if we choose to hybrid join them.

Having read through a lot of documentation already, it is not clear to me whether this can be achieved or whether MFA will be bypassed for said managed devices when outside the network.

Our concern is for potential situations where a bad actor gets their hands on an unlocked device and can open up a browser and directly access any Office 365 service.

Can anyone shine a light on this? What do we need to do, if anything? Thanks in advance.

fabs73514 · Answer

OECM_SupportUsing this logic, you also have the same problem if a smartphone is stolen and the PIN (which is even easier than a strong password) is known. The attacker would then have access to the MFA app and all M365 passwords, which are probably stored in the device's password manager. I would put the likelihood of someone stealing a smartphone and finding out the PIN higher than someone stealing the computer.The moral of the story: users can lose either a device or its password without being hacked right away. But once they lose both at the same time, there's a real security problem. It would be best to instruct users not to write passwords on a sticker on the device :).

headburgh · Answer

AllanWithHi&nbsp;in order to address the issues you describe you need to identify your public IP's and add those in the "Trusted locations" tab. Then all other clients coming from an IP not in the list will be prompted for MFA.&nbsp;However, CA will not block your account. So the credentials could still be leaked, although no access will be granted.https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/untrusted-networks&nbsp;If your organization is using VPN such as Direct Access och Always-on-VPN you´re in another kind of tight spot given that the IP will always originate from your external IP.&nbsp;Hope this helps&nbsp;/Viktor&nbsp;

vasilmichev · Answer

If the device is already authenticated and has a valid PRT, it will bypass any MFA requirements (having a PRT is considered the same as doing 2FA). They will still be prompted to perform MFA upon the initial device join, or when the PRT has expired.

allanwith · Answer

Hello Viktor - We have already added our own outgoing IP as a trusted network.
My question is whether an AAD joined device will prompt for MFA when I open up a browser and attempt to access an Office 365 service. As far as I can understand from Vasils response, they won't be challenged for MFA, if the device is AAD Joined and has a valid PRT.

allanwith · Answer

Hello Vasil, thank you for the response and for pointing me in the right direction. Is what you are saying, the same as what they are describing here:
https://docs.microsoft.com/en-us/azure/active-directory/devices/concept-primary-refresh-token#when-does-a-prt-get-an-mfa-claim
?
Essentially, that whenever a PRT requests a token, it does so by bypassing MFA or rather with the authority that MFA would grant it?

Do you see any security concerns in this approach in terms of bad actors getting their hands on an unlocked device? And what would be possible remedies?

Forum Discussion

Require MFA for AAD Hybrid joined devices

Share

Resources