Enhancing authentication strengths for Administrators

I have previously mentioned in a blog post that MFA spraying is a common technique used to breach organizations. Hackers send multiple requests in succession, hoping that a user will accept. To better protect certain users, such as administrators, it is recommended to use additional authentication strengths.

By using authentication strengths, an additional factor can be required. In this case, we will require phishing-resistant MFA for administrators. By phishing-resistant MFA, we mean Windows Hello For Business, FIDO2 Security Key or Certificate-based Authentication (Multifactor). Today, we will be using a FIDO2 Security Key.

First, we need to ensure that users are able to register the FIDO2 security key as an authentication method.

Azure AD Premium P1 license is required to use Condtional Access

1. Open https://portal.azure.com
2. Open Azure Active Directory
3. Open Security, then Authentication Methods
4. Open under policies on the right-side of the screen FIDO2 Security Key
   
5. Switch Enable to ON and save the configuration
   
   Note: In this case, we are opening up the use of the FIDO2 key to all users, but it is possible to target this to a specific group.
   
   Users are now able to configure FIDO2 key as an authentication method.

Registering FIDO2 key as an authentication method

1. Open a private browsing window.
2. Go to https://aka.ms/mfasetup
3. Sign-in with relevant administrator account
4. Choose in the security portal for Add Authentication Method – Security key
   
5. Choose USB Device
   
6. Choose External Securitykey
   
7. Fill in a pincode
   
8. Touch the key
   
9. Fill in a descriptive name such as Securitykey
   
10. As you can see, the Security key is now added as sign-in method
    
11. Close the Private browser

Force Administrators to sign-in with phishing-resistant MFA

To enforce that administrators must authenticate with phishing-resistant MFA, we will use conditional access.

1. Open https://portal.azure.com
2. Open Azure Active Directory
3. Open Security, then Conditional Access
4. Create a New policy
5. Fill in a descriptive name such as [All cloud apps] GRANT: Require Authentication Strength for Administrators and select the user which the policy needs to apply to.
   
6. Under Cloud apps or actions choose All Cloud apps
   
7. Under Conditions choose Require Authentication Strength: Phishing-resistant MFA
   
8. Switch enable policy to on and click save

User experience

1. Open a private browsing window.
2. Go to https://portal.azure.com
3. Sign-in with relevant administrator account
4. As you can see, the user is now forced to use the securitykey
   
5. Fill in the pincode and touch the key
   
6. You are now logged in with the security key

Thank you for taking the time to read my blog. Kindly share it with others if you find it helpful!