Setting up Office 365 for Multi-Factor Authentication

Transcription

1 Setting up Office 365 for Multi-Factor Authentication Office 365 now supports multiple factors of authentications when logging into any of theservices provided by Office 365. Organizations may want to use these multiple factors ofauthentication to further secure their user credentials, especially those organizations withbusiness regulatory compliance requirements such as HIPPA, PCI, and others. Office 365 supports the following factors of authentication: Call My Mobile Phone. The user receives a phone call that asks them to press the pound key. Once the pound key is pressed, the user is logged in. Text Code to My Mobile Phone. The user receives a text message containing a six-digit code that they must enter into the portal. Call My Office Phone. This is the same as Call My Mobile Phone, but it enables the user to select a different phone if they do nothave their mobile phone with them. Notify Me Through App. The user configured a smartphone appand they receive a notification in theapp that they must confirm the login.smartphone apps are available forwindows Phone, iphone, and Android devices. Show One-Time Code in App. The same smartphone app is used. Instead of receiving a notification, the user starts the app and enters the six digit code from the app into the portal. This brings further security and flexibility to the organization. This method can also be used to add ADFS as a form of authentication for a second factor. It is VERY IMPORTANT to read the Multi-Factor Authentication guide before deploying thesesteps as they could have adverse effects on authentication for users. End User Experience (Before Implementation): When an end user logs into the portal ( they will initially type in their username or address. If the domain which the user enters is a non-federated domain, they will have the option to type their password in. Otherwise, they will be redirected to their organization s federated sign in page:

2 This is what we expect. After a user enters their credentials, they will be taken to their home page. What we want to accomplish at this point is to add a second option for authentication during the sign on process, so when a user enters their password, it requires them to verify via another method (one of the five stated above). For this, we ll need to make some con guration changes both to the Tenant, and then to the user. Tenant Configuration: In the tenant, you will need to be a Global Administrator and head to the Admin > Office 365 side. Click on Users and Groups on the left hand side and take notice of the Set Multi-factor authentication requirements.

3 Click on Setup if it is not showing as active. You will be taken to an additional page, and from there you can choose the licensed users for whom to enable Multi-Factor authentication. You can also change service settings from this page such as allowing users to use app passwords to be able to sign into non-browser applications. Click on the checkbox next to the user, and then to the right click on Enable.

4 Confirm you wish to enable multiple factor authentication for the user(s): Ensure the account(s) updated successfully: You have now successfully enabled multi-factor authentication. Your users will now need to login the rst time and update their authentication factors. End User Experience: The user will log into the portal for the first time and after the account has been enabled for multi-factor authentication, they will need to provide several security questions.

5 After the user clicks on Set it up now they will have several options to fill out: You can choose to generate an App Password, which is recommended to have as a unique password per device. Because applications like Outlook, Lync, Of fice, OneNote, and mobile devices may not support multi-factor authentication, it is necessary to have these passwords. Users can generate new passwords from their settings page, shown later. The user will choose to use this app password shown in the browser when using Outlook or other apps when it rst requests the password. Now, you will need to configure your mobile phone, Outlook, Microsoft Office, and any other applications (Lync Mobile, Lync, Lync App,etc.) to use a new App Password. It is highly advised to use a new App Password per device. This can be done by going to Office 365 > Click the Gear > Office 365 Settings > Additional Verification > App Passwords. You would still want to setup ADFS as a factor, to avoid having to enter credentials twice with two forms of factors. More information can be found at the following link: